Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.
The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers.
inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible.
This vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.
This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to kernel from 3.0 before 10.6.2, 10.2.7.4 and 9.2.4.11.
CVSS Details
- CVSS 4.0 Base Score: 6.3 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade erlang | Aug 26, 2026 | Aug 26, 2026 |
| Ubuntu | — | Upgrade erlang-base-hipe (Ubuntu Pro)Upgrade erlang-ssh (Ubuntu Pro)Upgrade erlang-wx (Ubuntu Pro)Upgrade erlang-corba (Ubuntu Pro)Upgrade erlang-debugger (Ubuntu Pro)Upgrade erlang-tv (Ubuntu Pro)Upgrade erlang-os-mon (Ubuntu Pro)Upgrade erlang-dialyzer (Ubuntu Pro)Upgrade erlang-sshUpgrade erlang-webtool (Ubuntu Pro)Upgrade erlang-parsetoolsUpgrade erlangUpgrade erlang-edocUpgrade erlang-examplesUpgrade erlang-eunitUpgrade erlang-observer (Ubuntu Pro)Upgrade erlang-appmon (Ubuntu Pro)Upgrade erlang-erl-docgenUpgrade erlang-x11 (Ubuntu Pro)Upgrade erlang-manpagesUpgrade erlang-ic (Ubuntu Pro)Upgrade erlang-jinterface (Ubuntu Pro)Upgrade erlang-mnesiaUpgrade erlang-tftpUpgrade erlang-asn1Upgrade erlang-srcUpgrade erlang-ic-java (Ubuntu Pro)Upgrade erlang-toolsUpgrade erlang-devUpgrade erlang-public-keyUpgrade erlang-wxUpgrade erlang-erl-docgen (Ubuntu Pro)Upgrade erlang-runtime-tools (Ubuntu Pro)Upgrade erlang-snmp (Ubuntu Pro)Upgrade erlang-public-key (Ubuntu Pro)Upgrade erlang-baseUpgrade erlang-docUpgrade erlang-common-testUpgrade erlang-inetsUpgrade erlang-xmerlUpgrade erlang-cryptoUpgrade erlang-test-server (Ubuntu Pro)Upgrade erlang-toolbar (Ubuntu Pro)Upgrade erlang-xmerl (Ubuntu Pro)Upgrade erlang-manpages (Ubuntu Pro)Upgrade erlang-percept (Ubuntu Pro)Upgrade erlang-syntax-tools (Ubuntu Pro)Upgrade erlang-ftpUpgrade erlang-crypto (Ubuntu Pro)Upgrade erlang-src (Ubuntu Pro)Upgrade erlang-ftp (Ubuntu Pro)Upgrade erlang-mode (Ubuntu Pro)Upgrade erlang-et (Ubuntu Pro)Upgrade erlang-noxUpgrade erlang-reltool (Ubuntu Pro)Upgrade erlang-jinterfaceUpgrade erlang-common-test (Ubuntu Pro)Upgrade erlang-os-monUpgrade erlang-typer (Ubuntu Pro)Upgrade erlang-dev (Ubuntu Pro)Upgrade erlang-examples (Ubuntu Pro)Upgrade erlang-asn1 (Ubuntu Pro)Upgrade erlang-snmpUpgrade erlang-etUpgrade erlang-gs (Ubuntu Pro)Upgrade erlang-x11Upgrade erlang-odbc (Ubuntu Pro)Upgrade erlang (Ubuntu Pro)Upgrade erlang-observerUpgrade erlang-debuggerUpgrade erlang-reltoolUpgrade erlang-diameterUpgrade erlang-ssl (Ubuntu Pro)Upgrade erlang-nox (Ubuntu Pro)Upgrade erlang-eunit (Ubuntu Pro)Upgrade erlang-tools (Ubuntu Pro)Upgrade erlang-modeUpgrade erlang-diameter (Ubuntu Pro)Upgrade erlang-mnesia (Ubuntu Pro)Upgrade erlang-eldapUpgrade erlang-tftp (Ubuntu Pro)Upgrade erlang-doc (Ubuntu Pro)Upgrade erlang-sslUpgrade erlang-megacoUpgrade erlang-inets (Ubuntu Pro)Upgrade erlang-eldap (Ubuntu Pro)Upgrade erlang-runtime-toolsUpgrade erlang-base (Ubuntu Pro)Upgrade erlang-dialyzerUpgrade erlang-megaco (Ubuntu Pro)Upgrade erlang-odbcUpgrade erlang-edoc (Ubuntu Pro)Upgrade erlang-syntax-toolsUpgrade erlang-pman (Ubuntu Pro)Upgrade erlang-parsetools (Ubuntu Pro) | Oct 12, 2026 | Oct 8, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 7, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub