Input Validation Flaw in Erlang/OTP eldap Affects Availability

CVE-2026-70409

What is CVE-2026-70409?

A vulnerability exists in Erlang/OTP eldap that allows a malicious LDAP server to adversely affect application performance. Specifically, the flaw is due to improper validation of the port component in LDAP referral URLs. When processing these referrals, the eldap:parse_port/2 function does not place limits on the length of the port substring passed to the list_to_integer/1 function. This can result in lengthy processing times, as the conversion function does not restrict input size, leading to extensive arbitrary-precision arithmetic that can degrade the service’s availability significantly. The vulnerability necessitates the application to interact with the external server for referral handling, exposing systems to potential performance impacts.

References