CVE-2026-70405: Erlang/OTP SNMP DOS Vulnerability

CVE-2026-70405 Overview

CVE-2026-70405 is a denial-of-service vulnerability in the Erlang/OTP snmp application. A remote attacker can send a Simple Network Management Protocol (SNMP) message containing a Basic Encoding Rules (BER) INTEGER whose declared length field is arbitrarily large. The decoder accumulates the value across every declared byte using recursive shift and bitwise-or operations on a growing bignum, causing superlinear CPU work. Decoding runs before the Protocol Data Unit (PDU) is processed, so no valid request or authentication is required. The issue is classified as [CWE-1284] Improper Validation of Specified Quantity in Input.

Critical Impact
Unauthenticated network attackers can degrade availability of Erlang/OTP services exposing the snmp decoder by sending a single crafted BER-encoded SNMP message.

Affected Products

Erlang/OTP 17.0 through versions before 27.3.4.17 (snmp 4.25.1 through before 5.18.2.1)
Erlang/OTP 28.0 through versions before 28.5.0.6 (snmp 5.19 through before 5.20.2.2)
Erlang/OTP 29.0 through versions before 29.0.6 (snmp 5.20.3 through before 5.20.5)

Discovery Timeline

2026-09-01 - CVE-2026-70405 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-70405

Vulnerability Analysis

The defect resides in the SNMP PDU decoder in the Erlang/OTP snmp application. The function snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity. The helper do_dec_integer_notag/2 accumulates the value across every declared byte using a recursive shift and bitwise-or against a bignum that grows on each iteration. Because Erlang integers promote to arbitrary-precision bignums, work grows superlinearly with the declared length field.

A size-limited variant dec_integer_notag/2 exists, but it is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes. Every other decoded field uses the unbounded form. This includes the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value processed by dec_value/1.

Root Cause

The root cause is missing validation of the length field of a BER-encoded INTEGER before allocation and computation. The decoder trusts the attacker-declared length and performs proportional bignum arithmetic without bounding memory or CPU consumption.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a single SNMP datagram containing a BER INTEGER with an arbitrarily large length field to a listener that accepts SNMP messages. Decoding executes before PDU validation, so no valid community string, credentials, or well-formed request semantics are required beyond what the listener needs to accept the frame.

text

// Patch excerpt from Erlang/OTP: bound integer parsing to mitigate DoS
// File: lib/eldap/src/eldap.erl
-parse_port(Rest,Sport) ->
+parse_port(Rest,Sport) when length(Sport) =< 5 ->
     try list_to_integer(Sport)
     catch _:_ -> parse_error(parsing_port,Rest)
-    end.
+    end;
+parse_port(Rest, _) ->
+    parse_error(parsing_port, Rest).

Source: GitHub OTP Commit e3be1cf

The companion commit adds max_header_size and max_body_size bounding in the inets HTTP client, illustrating the same defensive pattern applied across the fix set:

text

// File: lib/inets/src/http_client/httpc_handler.erl
+    MaxHeaderSize = proplists:get_value(max_header_size, Request#request.request_options),
+    MaxBodySize = proplists:get_value(max_body_size, Request#request.request_options),
     {ok, State} =
         case {Address /= Request#request.address, Request#request.scheme} of
             {true, https} ->
                 connect_and_send_upgrade_request(Address, Request,
-                                                 #state{options = Options,
+                                                 #state{max_header_size = MaxHeaderSize,
+                                                        max_body_size = MaxBodySize,
+                                                        options = Options,
                                                         profile_name = ProfileName});

Source: GitHub OTP Commit aba0fe8

Detection Methods for CVE-2026-70405

Indicators of Compromise

Elevated CPU consumption or unresponsiveness in Erlang/OTP processes hosting the snmp application immediately after inbound UDP/161 traffic.
SNMP messages with abnormally large BER INTEGER length fields, particularly length prefixes that exceed reasonable protocol expectations.
Repeated small-volume SNMP datagrams from a single source correlating with beam.smp CPU spikes.

Detection Strategies

Perform deep packet inspection on UDP/161 traffic to flag BER INTEGER TLVs whose length octet indicates values far larger than legitimate SNMP fields require.
Monitor Erlang VM (beam.smp) scheduler utilization and correlate spikes with inbound SNMP flows.
Track Erlang/OTP snmp application versions across the estate and alert on hosts running versions listed in the affected ranges.

Monitoring Recommendations

Enable NetFlow or packet capture on management network segments carrying SNMP traffic and baseline typical PDU sizes.
Alert on SNMP packets exceeding expected size thresholds and on repeated malformed decode errors reported by the snmp application logs.
Track process memory growth on Erlang nodes exposing SNMP listeners to identify bignum-driven memory exhaustion.

How to Mitigate CVE-2026-70405

Immediate Actions Required

Upgrade Erlang/OTP to a fixed release: 27.3.4.17, 28.5.0.6, or 29.0.6, matching your major-version branch.
Restrict SNMP listener exposure to trusted management networks using host and network firewalls.
Audit deployed services to identify any embedded Erlang/OTP runtime that ships the snmp application.

Patch Information

The fix is delivered in the upstream Erlang/OTP commits aba0fe8c and e3be1cfe, which bound integer parsing across the inets, stdlib, eldap, and snmp applications. Additional detail is available in the GitHub Security Advisory GHSA-q7cq-pfgf-5hr7 and the CNA advisory.

Workarounds

Block or rate-limit inbound UDP/161 traffic at the network perimeter until the runtime is upgraded.
Disable the snmp application on Erlang/OTP nodes that do not require SNMP agent functionality.
Place SNMP listeners behind an SNMP-aware proxy or firewall capable of enforcing maximum PDU and field sizes.

bash

# Example: restrict inbound SNMP to a trusted management subnet on Linux
iptables -A INPUT -p udp --dport 161 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 161 -j DROP

# Verify installed Erlang/OTP version
erl -eval 'io:format("~s~n", [erlang:system_info(otp_release)]), halt().' -noshell