CVE-2026-28810
Erlang\/Otp 17.0 – 26.2.5.19
Raw vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-28810 is a medium-severity Generation of Predictable Numbers or Identifiers (CWE-340) vulnerability in Erlang Erlang\/Otp. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Name Resolution Poisoning and SMB Relay (T1557.001); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-20 (Secure Name/Address Resolution Service (Authoritative Source)) and SC-21 (Secure Name/Address Resolution Service (Recursive or Caching Resolver)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19582
Vulnerability Data
Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does not implement source port randomization. Response…
more
validation relies almost entirely on this ID, making DNS cache poisoning practical for an attacker who can observe one query or predict the next ID. This conflicts with RFC 5452 recommendations for mitigating forged DNS answers. inet_res is intended for use in trusted network environments and with trusted recursive resolvers. Earlier documentation did not clearly state this deployment assumption, which could lead users to deploy the resolver in environments where spoofed DNS responses are possible. This vulnerability is associated with program files lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl. This issue affects OTP from OTP 17.0 before OTP 28.4.2, OTP 27.3.4.10 and OTP 26.2.5.19, corresponding to kernel from 3.0 before 10.6.2, 10.2.7.4 and 9.2.4.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables DNS cache poisoning via predictable TXID and lack of port randomization, mapping to name resolution poisoning.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
- 6 hardening rules · 3 OS baselines
V11.3.4
Mitigating Controls (NIST 800-53 r5) AI
Directly requires data-origin authentication and integrity verification on DNS responses from authoritative sources, eliminating reliance on predictable 16-bit transaction IDs.
Mandates secure recursive/caching resolver behavior (including port and ID randomization per RFC 5452), directly blocking the inet_res cache-poisoning vector.
Requires timely application of patches that replace the sequential global transaction ID with randomized IDs and source-port randomization in kernel 10.6.2+.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require cryptographically strong RNG for identifiers and tokens, covering most of this weakness while the control addresses many additional development issues.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic controls require use of approved, sufficiently random algorithms and key-generation methods, directly mitigating predictable number/identifier weaknesses.
Security testing in development can detect predictable identifiers through static/dynamic analysis and fuzzing, reducing residual risk.
A secure SDLC incorporates threat modelling and secure-design reviews that flag predictable identifier generation early in the lifecycle.
Secure-coding standards explicitly forbid predictable random functions and mandate cryptographically secure RNGs, preventing the weakness at the source.
Secure authentication mechanisms depend on unpredictable session tokens, nonces and challenges; eliminating predictable identifiers strengthens authentication integrity.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-340
RHEL 7 (1 rule)
- V-204497 The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-340