CVE-2026-70409: Erlang/OTP eldap DOS Vulnerability

CVE-2026-70409 Overview

CVE-2026-70409 is a denial-of-service vulnerability in the Erlang/OTP eldap library. The flaw resides in eldap:parse_port/2, which forwards the port substring of an LDAP referral URL to list_to_integer/1 without any length bound. A malicious or compromised LDAP server can return a referral URL whose port component contains up to roughly 1.26 million digits. Parsing this value forces the caller into hundreds of milliseconds of arbitrary-precision arithmetic per referral, degrading availability [CWE-1284].

Reaching the flaw requires the application to explicitly pass a server-supplied referral to eldap:parse_ldap_url/1, since eldap itself never invokes that function on incoming referrals.

Critical Impact
A hostile LDAP server can trigger sustained CPU consumption on any Erlang/OTP client that parses referral URLs with eldap:parse_ldap_url/1, degrading service availability.

Affected Products

Erlang/OTP 17.0 through versions before 27.3.4.17 (eldap 1.0.3 before 1.2.14.2)
Erlang/OTP 28.0 through versions before 28.5.0.6 (eldap 1.2.15 before 1.2.16.1)
Erlang/OTP 29.0 through versions before 29.0.6 (eldap 1.3 before 1.3.1)

Discovery Timeline

2026-09-01 - CVE-2026-70409 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-70409

Vulnerability Analysis

The vulnerability is an algorithmic-complexity denial of service rooted in unbounded input to Erlang's arbitrary-precision integer parser. When eldap:parse_ldap_url/1 processes a referral URL, it splits out the port substring and calls parse_port/2. That function invokes list_to_integer/1 inside a try ... catch, but the catch only handles parse failures. A syntactically valid string of digits, no matter how long, parses successfully.

Because list_to_integer/1 accepts integers of any size by design, cost scales super-linearly with digit count. A port field with approximately 1.26 million digits costs hundreds of milliseconds of CPU per referral. An attacker who controls or compromises an LDAP server can amplify this by returning multiple large-port referrals per response.

Root Cause

The root cause is missing input-length validation at the trust boundary between server-supplied data and Erlang's bignum arithmetic. The upstream API contract for list_to_integer/1 documents unbounded input, so bounding is the caller's responsibility. eldap:parse_port/2 did not enforce that bound.

Attack Vector

The attack requires network access to influence LDAP responses reaching an Erlang/OTP client, plus the client application invoking eldap:parse_ldap_url/1 on server-supplied referral strings. No authentication or user interaction is required against the vulnerable client. Exploitation degrades availability; confidentiality and integrity are not affected.

erlang

%% Patch from lib/eldap/src/eldap.erl bounding port digit length to 5
%% Source: https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d

-parse_port(Rest,Sport) ->
+parse_port(Rest,Sport) when length(Sport) =< 5 ->
     try list_to_integer(Sport)
     catch _:_ -> parse_error(parsing_port,Rest)
-    end.
+    end;
+parse_port(Rest, _) ->
+    parse_error(parsing_port, Rest).

Source: GitHub OTP Commit Fix

The patch adds a guard clause rejecting any port substring longer than 5 characters, capping input at the maximum valid TCP port width and eliminating the algorithmic-complexity path.

Detection Methods for CVE-2026-70409

Indicators of Compromise

LDAP referral responses containing URLs with abnormally long numeric port fields (more than 5 digits).
Sustained CPU saturation in Erlang beam processes correlated with outbound LDAP queries.
Elevated latency or scheduler run-queue growth in Erlang nodes performing directory lookups.

Detection Strategies

Audit application code for calls to eldap:parse_ldap_url/1 that receive server-supplied referral strings without prior length validation.
Inspect LDAP traffic for Referral result elements containing URLs whose port components exceed valid TCP port width.
Monitor Erlang runtime telemetry for unexpected spikes in reductions or garbage collection on processes handling LDAP referrals.

Monitoring Recommendations

Instrument LDAP client wrappers to log referral URLs and reject inputs where the port field exceeds 5 characters.
Track process message queue lengths and CPU per Erlang scheduler to identify complexity-based denial of service.
Correlate outbound LDAP flows with backend service degradation to surface hostile or compromised directory servers.

How to Mitigate CVE-2026-70409

Immediate Actions Required

Upgrade Erlang/OTP to 27.3.4.17, 28.5.0.6, or 29.0.6, or later, depending on your major release track.
If upgrade is not immediately feasible, remove or gate any application code path that passes untrusted referral strings to eldap:parse_ldap_url/1.
Restrict outbound LDAP connectivity to trusted, authenticated directory servers only.

Patch Information

The fix is delivered in Erlang/OTP releases 27.3.4.17, 28.5.0.6, and 29.0.6, corresponding to eldap versions 1.2.14.2, 1.2.16.1, and 1.3.1. The change bounds the port substring length in parse_port/2 before invoking list_to_integer/1. See the GitHub Security Advisory GHSA-9vgh-c8cm-m9p4 and the CNA CVE-2026-70409 Details for full advisory content.

Workarounds

Wrap any invocation of eldap:parse_ldap_url/1 with a caller-side length check that rejects referral URLs whose port component exceeds 5 digits.
Validate LDAP referral URLs against RFC-compliant port ranges before parsing.
Terminate connections to directory servers that return malformed referral URLs to prevent repeated resource consumption.

bash

# Verify installed Erlang/OTP release contains the fix
erl -eval 'io:format("~s~n", [erlang:system_info(otp_release)]), halt().' -noshell

# Confirm the eldap application version is at or above the fixed release
erl -eval 'application:load(eldap), {ok, V} = application:get_key(eldap, vsn), io:format("eldap ~s~n", [V]), halt().' -noshell