Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HErlang Rebar3
APPErlang3.7.0 – 3.7.5
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
Related vulnerabilities
CVE-2020-13802CRITICAL9.8PL ✓same product
Rebar3 – command injection przez parametr URL zależności
CVE-2026-21619LOW2.0same product
Podatność Uncontrolled Resource Consumption oraz Deserialization of Untrusted Data w modułach hex_api bibliote...
CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓same vendor
Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)
CVE-2026-55953CRITICAL9.1same vendor
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the...
CVE-2022-37026CRITICAL9.8PL ✓same vendor
Erlang/OTP – obejście uwierzytelniania klienta w SSL/TLS/DTLS