products / erlang

Erlang/OTP

Erlang/OTP is the runtime and standard library behind distributed systems such as RabbitMQ. NVD lists the product as cpe:2.3:a:erlang:erlang/otp. Critical history centers on the OTP SSH server, SSL/TLS client authentication, and the inets HTTP daemon.

api usage

Querying Erlang/OTP

product slugerlang

version format26.2.1, 27.3.4, 25.3.2

bash

curl "https://api.attestd.io/v1/check?product=erlang&version=26.2.1" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Erlang/OTP 26.2.1 is affected by CVE-2025-32433 (unauthenticated RCE in the OTP SSH server, CVSS 10.0). The response shows a critical risk_state with a fixed_version of 26.2.5.

json

{
  "product": "erlang",
  "version": "26.2.1",
  "supported": true,
  "risk_state": "none",
  "risk_factors": [],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 0.9,
  "cve_ids": [],
  "cves": null,
  "max_epss": null,
  "last_updated": "2026-08-16T14:20:00.780327Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Erlang/OTP 27.3.4 is past the CVE-2025-32433 patch floors on the 27 line (fixed in 27.3.3 and later).

bash

curl "https://api.attestd.io/v1/check?product=erlang&version=27.3.4" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

OTP networking components (SSH, ssl, inets) dominate the high-score record. CVE-2025-32433 is in the CISA KEV catalog and forces immediate upgrades on any host that exposes the OTP SSH daemon.

CVE	Description	Affects	CVSS
`CVE-2025-32433`KEV	SSH protocol message-handling flaw allows unauthenticated remote code execution on the OTP SSH server.	<25.3.2.20 / <26.2.5.11 / <27.3.3	10.0
`CVE-2022-37026`	Client-certificate authentication bypass in SSL/TLS/DTLS accepts unauthorized clients.	<23.3.4.15 / <24.3.4.2 / <25.0.2	9.8
`CVE-2020-25623`	Directory traversal in inets httpd lets attackers read arbitrary files via crafted HTTP.	22.3 / 23.0	7.5
`CVE-2020-35733`	ssl trusts invalid X.509 chains to a trusted root CA.	<23.2.2	7.5

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Erlang/OTP CPE namespace

NVD uses a single CPE product string that includes a slash in the product field:

cpe:2.3:a:erlang:erlang/otpErlang/OTP runtime and stdlib

Attestd maps the erlang product slug to this CPE. Deployments that ship OTP as a dependency of RabbitMQ should also check the RabbitMQ product page.

All products RabbitMQ Go Quickstart