CVE-2026-28810: 
Erlang OTP vulnerability analysis and mitigation

CVE-2026-28810 is a DNS cache poisoning vulnerability in the Erlang/OTP built-in DNS resolver (inet_res) caused by predictable transaction IDs and lack of source port randomization. Disclosed on April 7, 2026, it affects Erlang/OTP versions from 17.0 up to (but not including) 26.2.5.19, 27.3.4.10, and 28.4.2, corresponding to kernel versions from 3.0 up to 9.2.4.11, 10.2.7.4, and 10.6.2. The vulnerability is classified as CWE-340 (Generation of Predictable Numbers or Identifiers) and carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause (CWE-340) lies in inet_res using a sequential, process-global 16-bit transaction ID counter for UDP DNS queries, with no source port randomization. Because response validation relies almost entirely on matching this predictable ID, an attacker who can observe a single outgoing DNS query — or simply predict the next sequential ID — can craft a forged DNS response that the resolver will accept. This design directly conflicts with RFC 5452 recommendations for making DNS more resilient against forged answers. The vulnerable code resides in lib/kernel/src/inet_res.erl and lib/kernel/src/inet_db.erl; the fix introduces cryptographically strong random transaction IDs and randomized source port binding via crypto:rand_uniform/2 (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to inject malicious DNS records into the resolver's cache, redirecting Erlang/OTP applications to attacker-controlled hosts. The primary impact is on integrity (low, per CVSS), as confidentiality and availability are not directly affected. However, in practice, DNS cache poisoning can enable man-in-the-middle attacks, credential harvesting, or traffic interception against any Erlang/OTP application that relies on inet_res for name resolution in environments where DNS traffic can be observed or spoofed (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-28810. The EPSS score is approximately 0.05%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to be able to observe DNS queries from the target Erlang node or predict the sequential transaction ID, which is feasible in network positions with traffic visibility but not trivially achievable from the open internet (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Erlang/OTP nodes (versions 17.0–28.4.1) that use inet_res for DNS resolution, particularly those deployed in environments where UDP DNS traffic is observable (e.g., shared network segments, cloud VPCs without strict network isolation).
2. Observe or predict transaction ID: Monitor outgoing UDP DNS queries from the target node to identify the current sequential 16-bit transaction ID. Because IDs are incremented globally and sequentially, observing one query is sufficient to predict subsequent IDs.
3. Craft forged DNS response: Prepare a spoofed UDP DNS response packet with the predicted transaction ID, a matching source IP (the legitimate resolver's IP), and a malicious answer record (e.g., pointing a target hostname to an attacker-controlled IP).
4. Race the legitimate response: Send the forged response to the Erlang node's source port before the legitimate resolver replies. Since source port randomization is absent in vulnerable versions, the attacker only needs to match the fixed or predictable source port.
5. Cache poisoning achieved: The inet_res resolver accepts the forged response, caching the malicious DNS record. Subsequent DNS lookups by the Erlang application for the poisoned hostname will resolve to the attacker-controlled address, enabling traffic interception or redirection (GitHub Advisory).

• Network: Unexpected UDP DNS responses arriving at the Erlang node from the resolver's IP with transaction IDs that match outgoing queries but contain anomalous answer records; duplicate DNS responses for the same query ID from different source IPs.
• Logs: Erlang application logs showing connections to unexpected IP addresses for well-known hostnames; DNS resolution results that differ from authoritative records when cross-checked externally.
• Process/Application: Erlang nodes connecting to unexpected upstream services or exhibiting TLS certificate errors due to hostname/IP mismatch caused by poisoned DNS entries.

Erlang/OTP has released patched versions that introduce cryptographically strong random DNS transaction IDs and source port randomization: OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2 (kernel versions 9.2.4.11, 10.2.7.4, and 10.6.2 respectively). Upgrading to one of these versions is the recommended remediation. As a workaround for environments that cannot upgrade immediately, deploy Erlang nodes in trusted, isolated networks shielded from DNS reply spoofing by firewalls, and configure inet_res to communicate only with trusted recursive name servers within that network (GitHub Advisory, OTP 28.4.2 Release).

The vulnerability was reported by researcher LuiginoC and the advisory was published by RaimoNiskanen of the Erlang/OTP team on April 7, 2026. Patch announcements for all three supported branches were posted to the Erlang Forums and Elixir Forum shortly after disclosure, indicating prompt vendor response. Coverage appeared in Linux security digests (Pro-Linux, LinuxCompatible) and was picked up by OpenSUSE security announcements, reflecting standard downstream distribution patching activity (OTP 28.4.2 Release, OTP 27.3.4.10 Release, OTP 26.2.5.19 Release).