The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8901-1 advisory.

    Wander Nauta discovered that Erlang incorrectly handled absolute paths when extracting zip archives. An     attacker could possibly use this issue to write arbitrary files outside of the intended directory. This     issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-4748)

    It was discovered that the Erlang SFTP server did not properly limit the size of packets. A remote     attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of     service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
    (CVE-2025-26618)

    It was discovered that the Erlang SSH server did not properly limit the length of algorithm names in key     exchange messages. A remote attacker could possibly use this issue to cause Erlang to use excessive     resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,     and Ubuntu 18.04 LTS. (CVE-2025-30211)

    It was discovered that the Erlang TFTP server incorrectly handled certain file paths. A remote attacker     could possibly use this issue to access files outside of the intended directory. (CVE-2026-21620)

    It was discovered that the Erlang SFTP server incorrectly validated paths against the configured root     directory. An authenticated user could possibly use this issue to access files outside of the root     directory. (CVE-2026-23942)

    It was discovered that the Erlang SSH server enabled zlib compression by default and did not limit the     size of decompressed data. A remote attacker could possibly use this issue to cause Erlang to use     excessive resources, leading to a denial of service. (CVE-2026-23943)

    It was discovered that the Erlang HTTP server incorrectly applied directory access controls to CGI scripts     served via script aliases. A remote attacker could possibly use this issue to bypass authentication and     access protected CGI scripts. (CVE-2026-28808)

    It was discovered that the Erlang DNS resolver used predictable transaction IDs and did not randomize     source ports. A remote attacker could possibly use this issue to perform DNS cache poisoning attacks. This     issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-28810)

    It was discovered that Erlang did not verify the signatures of designated OCSP responder certificates. A     remote attacker could possibly use this issue to forge OCSP responses and bypass certificate revocation     checks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32144)

    It was discovered that the Erlang SFTP server incorrectly handled file attribute changes on open file     handles. An authenticated user could possibly use this issue to modify the attributes of files outside of     the root directory. (CVE-2026-32147)

    It was discovered that Erlang incorrectly allowed non-CA certificates to act as intermediate certificate     issuers. A remote attacker could possibly use this issue to forge certificate chains. (CVE-2026-42789)

    It was discovered that Erlang incorrectly handled DNS name constraints during hostname verification. A     remote attacker could possibly use this issue to bypass certificate validation. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-42790)

    It was discovered that Erlang did not check the validity period of OCSP responder certificates. A remote     attacker could possibly use this issue to forge OCSP responses using an expired responder certificate.
    This issue only affected Ubuntu 26.04 LTS. (CVE-2026-42791)

    It was discovered that Erlang incorrectly handled relative paths when extracting zip archives. An attacker     could possibly use this issue to write arbitrary files outside of the intended directory. This issue only     affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-47078)

    It was discovered that the Erlang SFTP server exposed absolute paths when reading symbolic links. An     authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-48855)

    It was discovered that the Erlang HTTP client forwarded authorization headers on cross-origin redirects. A     malicious HTTP server could possibly use this issue to obtain sensitive information. (CVE-2026-48856)

    It was discovered that the Erlang FTP client did not validate the IP address in passive mode responses. A     malicious FTP server could possibly use this issue to perform server-side request forgery attacks.
    (CVE-2026-48858)

    It was discovered that Erlang checked the local address instead of the peer address when enforcing the     allowlist for distribution over TLS. A remote attacker could possibly use this issue to bypass access     restrictions. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-48860)

    It was discovered that Erlang incorrectly handled certain SCTP ERROR chunks, leading to a buffer overflow.
    A remote attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of     service. (CVE-2026-49759)

    It was discovered that the Erlang erl_interface library incorrectly handled printing very large integers,     leading to a buffer overflow. An attacker could possibly use this issue to cause Erlang to crash or     execute arbitrary code. (CVE-2026-49760)

    It was discovered that the Erlang SFTP server incorrectly handled certain path resolution requests. An     authenticated user could possibly use this issue to determine the existence of files outside of the root     directory. (CVE-2026-53422)

    It was discovered that the Erlang SFTP server incorrectly handled extended channel data, leading to an     infinite loop. An authenticated user could possibly use this issue to cause a denial of service.
    (CVE-2026-54886)

    It was discovered that the Erlang DTLS server used a predictable cookie secret on startup. A remote     attacker could possibly use this issue to bypass source address verification. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-54887)

    It was discovered that Erlang TLS clients incorrectly accepted application data before the handshake was     completed. A remote attacker could possibly use this issue to inject arbitrary data into TLS connections.
    (CVE-2026-54891)

    It was discovered that the Erlang DTLS server contained a race condition when handling rapid client     reconnections. A remote attacker could possibly use this issue to cause Erlang to crash, resulting in a     denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-55950)

    It was discovered that Erlang did not properly validate TLS 1.3 pre-shared key extensions. A remote     attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. This     issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-55952)

    It was discovered that the Erlang ASN.1 decoder incorrectly handled certain object identifiers. A remote     attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of     service. (CVE-2026-65634)

    It was discovered that the Erlang SSH server did not properly limit the number of open channels. An     authenticated user could possibly use this issue to cause Erlang to use excessive resources, leading to a     denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu     22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-68956)

    It was discovered that the Erlang HTTP server incorrectly shared users and groups between directories when     using dets or mnesia authentication backends. A remote attacker could possibly use this issue to bypass     authentication and access protected directories. (CVE-2026-74994)

    It was discovered that Erlang TLS clients incorrectly accepted unsolicited TLS 1.3 pre-shared keys from     servers. A remote attacker could possibly use this issue to impersonate servers. This issue only affected     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-89422)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication     backends and multiple directory configuration blocks, collapses all directory blocks into a single shared     user/group namespace. A user added to one protected directory is accepted as valid for all other protected     directories on the same server instance. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from     OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before     9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to     inets before 5.10, is affected is unknown. (CVE-2026-74994)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e9dfc357-a63f-11f1-9195-4c526214c986 advisory.

    The Erlang/OTP project reports:
    OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following               issues, most of them in the inets httpd and httpc               implementations:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
365371	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Erlang vulnerabilities (USN-8901-1)	Nessus	Ubuntu Local Security Checks	Local	critical
342627	Linux Distros Unpatched Vulnerability : CVE-2026-74994	Nessus	Misc.	Local	medium
342490	FreeBSD : Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap (e9dfc357-a63f-11f1-9195-4c526214c986)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2026-74994

medium

Tenable Plugins

critical

medium

high