Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-dccw-cx8r-r7a1

Summary Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake. This issue has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25).

Aliases

alias	CVE-2025-46712

Fixed_packages

url	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=aarch64&distroversion=v3.21&reponame=community
purl	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=aarch64&distroversion=v3.21&reponame=community
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:apk/alpine/erlang@26.2.5.12-r0%3Farch=aarch64&distroversion=v3.21&reponame=community

url	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=armhf&distroversion=v3.21&reponame=community
purl	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=armhf&distroversion=v3.21&reponame=community
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:apk/alpine/erlang@26.2.5.12-r0%3Farch=armhf&distroversion=v3.21&reponame=community

url	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=armv7&distroversion=v3.21&reponame=community
purl	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=armv7&distroversion=v3.21&reponame=community
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:apk/alpine/erlang@26.2.5.12-r0%3Farch=armv7&distroversion=v3.21&reponame=community

url	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=loongarch64&distroversion=v3.21&reponame=community
purl	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=loongarch64&distroversion=v3.21&reponame=community
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:apk/alpine/erlang@26.2.5.12-r0%3Farch=loongarch64&distroversion=v3.21&reponame=community

url	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=ppc64le&distroversion=v3.21&reponame=community
purl	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=ppc64le&distroversion=v3.21&reponame=community
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:apk/alpine/erlang@26.2.5.12-r0%3Farch=ppc64le&distroversion=v3.21&reponame=community

url	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=riscv64&distroversion=v3.21&reponame=community
purl	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=riscv64&distroversion=v3.21&reponame=community
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:apk/alpine/erlang@26.2.5.12-r0%3Farch=riscv64&distroversion=v3.21&reponame=community

url	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=s390x&distroversion=v3.21&reponame=community
purl	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=s390x&distroversion=v3.21&reponame=community
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:apk/alpine/erlang@26.2.5.12-r0%3Farch=s390x&distroversion=v3.21&reponame=community

url	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=x86&distroversion=v3.21&reponame=community
purl	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=x86&distroversion=v3.21&reponame=community
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:apk/alpine/erlang@26.2.5.12-r0%3Farch=x86&distroversion=v3.21&reponame=community

url	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=x86_64&distroversion=v3.21&reponame=community
purl	pkg:apk/alpine/erlang@26.2.5.12-r0?arch=x86_64&distroversion=v3.21&reponame=community
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:apk/alpine/erlang@26.2.5.12-r0%3Farch=x86_64&distroversion=v3.21&reponame=community

url	pkg:deb/debian/erlang@1:25.2.3%2Bdfsg-1%2Bdeb12u2?distro=trixie
purl	pkg:deb/debian/erlang@1:25.2.3%2Bdfsg-1%2Bdeb12u2?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/erlang@1:25.2.3%252Bdfsg-1%252Bdeb12u2%3Fdistro=trixie

url pkg:deb/debian/erlang@1:25.2.3%2Bdfsg-1%2Bdeb12u4?distro=trixie

purl pkg:deb/debian/erlang@1:25.2.3%2Bdfsg-1%2Bdeb12u4?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2uh8-nhph-gfb6

vulnerability	VCID-883b-48uw-6yag

vulnerability	VCID-b3hg-mjga-nbg1

vulnerability	VCID-dazh-ypb5-akfp

vulnerability	VCID-ryy7-f45d-yyhv

vulnerability	VCID-wsby-unw4-zqe7

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/erlang@1:25.2.3%252Bdfsg-1%252Bdeb12u4%3Fdistro=trixie

url pkg:deb/debian/erlang@1:25.2.3%2Bdfsg-1%2Bdeb12u4

purl pkg:deb/debian/erlang@1:25.2.3%2Bdfsg-1%2Bdeb12u4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2uh8-nhph-gfb6

vulnerability	VCID-883b-48uw-6yag

vulnerability	VCID-b3hg-mjga-nbg1

vulnerability	VCID-dazh-ypb5-akfp

vulnerability	VCID-ryy7-f45d-yyhv

vulnerability	VCID-wsby-unw4-zqe7

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/erlang@1:25.2.3%252Bdfsg-1%252Bdeb12u4

url	pkg:deb/debian/erlang@1:27.3.4%2Bdfsg-1?distro=trixie
purl	pkg:deb/debian/erlang@1:27.3.4%2Bdfsg-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/erlang@1:27.3.4%252Bdfsg-1%3Fdistro=trixie

url pkg:deb/debian/erlang@1:27.3.4.1%2Bdfsg-1%2Bdeb13u2?distro=trixie

purl pkg:deb/debian/erlang@1:27.3.4.1%2Bdfsg-1%2Bdeb13u2?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2uh8-nhph-gfb6

vulnerability	VCID-883b-48uw-6yag

vulnerability	VCID-aqqx-g7d3-1yfy

vulnerability	VCID-dazh-ypb5-akfp

vulnerability	VCID-n6dc-39d1-83cr

vulnerability	VCID-ryy7-f45d-yyhv

vulnerability	VCID-wsby-unw4-zqe7

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/erlang@1:27.3.4.1%252Bdfsg-1%252Bdeb13u2%3Fdistro=trixie

url	pkg:deb/debian/erlang@1:27.3.4.12%2Bdfsg-1?distro=trixie
purl	pkg:deb/debian/erlang@1:27.3.4.12%2Bdfsg-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/erlang@1:27.3.4.12%252Bdfsg-1%3Fdistro=trixie

Affected_packages

url pkg:deb/debian/erlang@1:23.2.6%2Bdfsg-1%2Bdeb11u1

purl pkg:deb/debian/erlang@1:23.2.6%2Bdfsg-1%2Bdeb11u1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2uh8-nhph-gfb6

vulnerability	VCID-883b-48uw-6yag

vulnerability	VCID-b3hg-mjga-nbg1

vulnerability	VCID-dazh-ypb5-akfp

vulnerability	VCID-dccw-cx8r-r7a1

vulnerability	VCID-ryy7-f45d-yyhv

vulnerability	VCID-wsby-unw4-zqe7

vulnerability	VCID-yyfx-f783-fqgk

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/erlang@1:23.2.6%252Bdfsg-1%252Bdeb11u1

url pkg:deb/debian/erlang@1:23.2.6%2Bdfsg-1%2Bdeb11u1?distro=trixie

purl pkg:deb/debian/erlang@1:23.2.6%2Bdfsg-1%2Bdeb11u1?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-2uh8-nhph-gfb6

vulnerability	VCID-883b-48uw-6yag

vulnerability	VCID-b3hg-mjga-nbg1

vulnerability	VCID-dazh-ypb5-akfp

vulnerability	VCID-dccw-cx8r-r7a1

vulnerability	VCID-ryy7-f45d-yyhv

vulnerability	VCID-wsby-unw4-zqe7

vulnerability	VCID-yyfx-f783-fqgk

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/erlang@1:23.2.6%252Bdfsg-1%252Bdeb11u1%3Fdistro=trixie

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2025-46712

reference_id

reference_type

scores

value	0.00406
scoring_system	epss
scoring_elements	0.61431
published_at	2026-06-05T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2025-46712

reference_url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46712
reference_id
reference_type
scores
url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46712

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104963
reference_id	1104963
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104963

reference_url

https://github.com/erlang/otp/commit/e4b56a9f4a511aa9990dd86c16c61439c828df83

reference_id

e4b56a9f4a511aa9990dd86c16c61439c828df83

reference_type

scores

value	3.7
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T20:02:52Z/

url

https://github.com/erlang/otp/commit/e4b56a9f4a511aa9990dd86c16c61439c828df83

reference_url

https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf

reference_id

GHSA-934x-xq38-hhqf

reference_type

scores

value	3.7
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T20:02:52Z/

url

https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf

reference_url

https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21

reference_id

OTP-25.3.2.21

reference_type

scores

value	3.7
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T20:02:52Z/

url

https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21

reference_url

https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12

reference_id

OTP-26.2.5.12

reference_type

scores

value	3.7
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T20:02:52Z/

url

https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12

reference_url

https://github.com/erlang/otp/releases/tag/OTP-27.3.4

reference_id

OTP-27.3.4

reference_type

scores

value	3.7
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

value	Track
scoring_system	ssvc
scoring_elements	SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-08T20:02:52Z/

url

https://github.com/erlang/otp/releases/tag/OTP-27.3.4

reference_url	https://usn.ubuntu.com/7656-1/
reference_id	USN-7656-1
reference_type
scores
url	https://usn.ubuntu.com/7656-1/

Weaknesses

cwe_id	440
name	Expected Behavior Violation
description	A feature, API, or function does not perform according to its specification.

Exploits

Severity_range_score 3.7 - 3.7

Exploitability 0.5

Weighted_severity 0.0

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dccw-cx8r-r7a1

Vulnerability Instance