CVE-2026-28810

MEDIUM EPSS 18.5%
Published Apr 7, 20262mo ago · Modified Jun 17, 20261w ago
6.3 CVSS 4.0
Medium
Find Similar
Published Apr 7, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers. inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible. This vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl. This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to kernel from 3.0 until 10.6.2, 10.2.7.4 and 9.2.4.11.

CVSS Details

Base Score
6.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
18.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-340

Affected Products 3

VendorProductVersionRange
erlangerlang\/otp*≥17.0  –  <26.2.5.19
erlangerlang\/otp*≥27.0  –  <27.3.4.10
erlangerlang\/otp*≥28.0  –  <28.4.2

References 7

  • cna.erlef.org https://cna.erlef.org/cves/CVE-2026-28810.html
    Third Party Advisory
  • github.com https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5
    Patch
  • github.com https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8
    Patch
  • github.com https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd
    Patch
  • github.com https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8
    Vendor Advisory
  • osv.dev https://osv.dev/vulnerability/EEF-CVE-2026-28810
    Third Party Advisory
  • erlang.org https://www.erlang.org/doc/system/versions.html#order-of-versions
    Release Notes

Remediation

  • github.com https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5
    Patch
  • github.com https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8
    Patch
  • github.com https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fd
    Patch