Why SolarWinds Observability Self-Hosted is not affected by multiple Erlang OTP vulnerabilities

10/14/2026 6:40 PM

10/14/2026 6:40 PM

In 2026, the National Institute of Standards and Technology (NIST) published security bulletins about the following Erlang OTP vulnerabilities:

NVD-CVE-2026-70409
NVD-CVE-2026-49760
NVD-CVE-2026-71562
NVD-CVE-2026-74994
NVD-CVE-2026-32144
NVD-CVE-2026-42791
NVD-CVE-2026-70405
NVD-CVE-2026-68956
NVD-CVE-2026-48855
NVD-CVE-2026-89422
NVD-CVE-2026-48860
NVD-CVE-2026-59696
NVD-CVE-2026-47078

Orion Platform

CVE-2026-70409 is a denial-of-service vulnerability in Erlang/OTP's LDAP client component (eldap). A malicious or compromised LDAP server can return a referral URL containing an excessively long numeric port value, causing expensive integer conversion and degrading application availability.

CVE-2026-49760 is a stack-based buffer overflow vulnerability in Erlang/OTP's erl_interface component. Processing an encoded Erlang term containing an extremely large integer can overflow an internal stack buffer in ei_s_print_term, potentially crashing the process and causing denial of service.

CVE-2026-71562 is a denial-of-service vulnerability in Erlang/OTP's HTTP client (httpc). A malicious or compromised HTTP server can return numeric header values, such as Content-Length or Retry-After, containing excessively long sequences of digits, causing expensive integer conversions and degrading availability.

CVE-2026-74994 is an authentication-bypass vulnerability in Erlang/OTP's inets HTTP server. When mod_auth uses DETS or Mnesia authentication backends with multiple directory configuration blocks, users authenticated for one protected directory may gain unauthorized access to other protected directories on the same server.

CVE-2026-32144 is an improper certificate validation vulnerability in Erlang/OTP's public_key and SSL components. The OCSP response validation process fails to verify the issuing CA's cryptographic signature on a designated OCSP responder certificate, potentially allowing an attacker to forge OCSP responses that incorrectly mark revoked certificates as valid.

CVE-2026-42791 is an improper certificate validation vulnerability in Erlang/OTP's public_key component. The OCSP validation process does not check the validity period of the responder certificate, potentially allowing forged OCSP responses signed with an expired responder certificate to be accepted as valid.

CVE-2026-70405 is a denial-of-service vulnerability in Erlang/OTP's SNMP component. An attacker can send a crafted SNMP message containing an excessively large BER INTEGER length, causing expensive integer processing and potentially degrading the availability of the affected system.

CVE-2026-68956 is a denial-of-service vulnerability in Erlang/OTP's SSH server. An authenticated remote attacker can repeatedly open session channels without assigning handlers, bypassing the configured channel limit and consuming memory until the Erlang virtual machine crashes.

CVE-2026-48855 is an information disclosure vulnerability in Erlang/OTP's SSH SFTP server. When the SFTP subsystem is configured with a root directory, an authenticated client can create and read a symbolic link to disclose the absolute backend filesystem path, revealing filesystem layout information.

CVE-2026-89422 is an authentication-bypass vulnerability in Erlang/OTP's TLS 1.3 client. A server can supply an unsolicited pre_shared_key extension that causes the client to skip certificate and hostname validation, potentially allowing an on-path attacker to impersonate the intended server.

CVE-2026-48860 is an authorization vulnerability in Erlang/OTP's TLS-based Erlang distribution. An incorrect socket-address lookup causes the configured LAN IP allowlist check to compare the local address instead of the remote peer's address, potentially allowing a holder of a CA-signed TLS certificate to bypass the network restriction and access Erlang distribution functionality.

CVE-2026-59696 is a denial-of-service vulnerability in Erlang/OTP's stdlib URI parser. An attacker can supply a URI containing an excessively long numeric port value, causing expensive integer conversion and degrading the availability of applications that parse untrusted URIs.

CVE-2026-47078 is a path traversal vulnerability in Erlang/OTP's ZIP extraction functionality. Improper directory-depth validation in zip:unzip and zip:extract can allow a crafted ZIP archive to bypass path checks and write files outside the intended extraction directory.

SolarWinds Observability Self-Hosted is not affected CVE-2026-70409, CVE-2026-49760, CVE-2026-71562, CVE-2026-74994, CVE-2026-32144, CVE-2026-42791, CVE-2026-70405, CVE-2026-68956, CVE-2026-48855, CVE-2026-89422, CVE-2026-48860, CVE-2026-59696, CVE-2026-47078.

CVE-2026-89422: SolarWinds Observability Self-Hosted does not use RabbitMQ/Erlang OTP as a TLS or DTLS client in the affected functionality. The vulnerable client-side functionality is therefore not in the execution path of the deployed product.

CVE-2026-70405: SolarWinds Observability Self-Hosted does not use the Erlang/OTP SNMP functionality. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-68956, CVE-2026-48855: SolarWinds Observability Self-Hosted does not use the Erlang/OTP SSH or SFTP functionality. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-70409: SolarWinds Observability Self-Hosted does not use LDAP functionality in its RabbitMQ deployment. The vulnerable LDAP client functionality is therefore not in the execution path of the deployed product.

CVE-2026-71562: SolarWinds Observability Self-Hosted does not use the affected Erlang/OTP HTTP client functionality for outbound HTTP requests. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-49760: SolarWinds Observability Self-Hosted does not directly use the affected Erlang/OTP ei_s_print_term function. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-59696: SolarWinds Observability Self-Hosted does not use the Erlang/OTP URI parsing functionality that invokes the affected function with untrusted input. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-47078: SolarWinds Observability Self-Hosted does not use the affected Erlang/OTP ZIP extraction functions. The vulnerable functionality is therefore not in the execution path of the deployed product.

CVE-2026-74994: SolarWinds Observability Self-Hosted uses the Cowboy web server rather than the Erlang/OTP inets:httpd server. The vulnerable HTTP authentication functionality is therefore not in the execution path of the deployed product

CVE-2026-32144, CVE-2026-42791: The Erlang/OTP version used by SolarWinds Observability Self-Hosted, is not affected by these vulnerabilities according to the applicable version information. In addition, the affected OCSP functionality is not used in the RabbitMQ deployment.

CVE-2026-48860: SolarWinds Observability Self-Hosted does not use the Erlang/OTP inet_tls distribution mechanism. The vulnerable distribution functionality is therefore not in the execution path of the deployed product.