CVE-2026-28810

Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers. inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible. This vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl. This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to kernel from 3.0 before 10.6.2, 10.2.7.4 and 9.2.4.11.

• CWE-340

• https://cna.erlef.org/cves/CVE-2026-28810.htmlThird Party Advisory
• https://github.com/erlang/otp/commit/36f23c9d2cc54afe83671dd7343596d7972839a5Patch
• https://github.com/erlang/otp/commit/b057a9d995017b1be50d6dc02edd52382f3231b8Patch
• https://github.com/erlang/otp/commit/dd15e8eb03548c5e55e9915f0e91389ec6bad9fdPatch
• https://github.com/erlang/otp/security/advisories/GHSA-v884-5jg5-whj8Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-28810Third Party Advisory
• https://www.erlang.org/doc/system/versions.html#order-of-versionsRelease Notes

Published

Apr 7, 2026

Last Modified

Jul 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28805OpenSTAManager is an open source management software for tec…8.8
• CVE-2026-28806Improper Authorization vulnerability in nerves-hub nerves_hu…8.8
• CVE-2026-28807Improper Limitation of a Pathname to a Restricted Directory …7.5
• CVE-2026-28808Incorrect Authorization vulnerability in Erlang OTP (inets m…9.8
• CVE-2026-28809XML External Entity (XXE) vulnerability in esaml (and its fo…5.3
• CVE-2026-2881A vulnerability has been found in D-Link DWR-M960 1.01.07. T…8.8
• CVE-2026-28811Debug Messages Revealing Unnecessary Information in Apache J…7.5
• CVE-2026-28812UserManager lack of checks allows impersonation in Apache JS…9.8
• CVE-2026-28813Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijackin…8.8
• CVE-2026-28814Arbitrary Wiki Markup rendering due to lack of authenticatio…7.5
• CVE-2026-28815A remote attacker can supply a short X-Wing HPKE encapsulate…7.5
• CVE-2026-28816A path handling issue was addressed with improved validation…4