Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.
Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.
Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host
Medium(6.3)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a deni
High(8.2)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshak
High(8.2)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are neve
High(7.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the
Critical(9.3)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of dig
Medium(6.9)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port compon
Medium(6.3)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length fi
Medium(6.3)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single s
Medium(6.5)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature beca
Critical(9.3)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked bo
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large nu
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with diffe
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OT
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_bod
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6,
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer i
Critical(9.1)
AffectedDetails (3)
1:27.3.4.1+dfsg-1+deb13u3 · amd64 · trixie-security · Historical version
