CVE-2015-2774: Erlang Erlang/otp

Medium severity, CVSS 5.9. EPSS: 1.9% chance of exploitation in the next 30 days.

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).

Affected products

• Erlang Erlang/otp: up to and including 18.0
• Opensuse Opensuse: version 13.2 only
• Oracle Solaris: version 11.2 only

Published 2016-04-07. Last modified 2026-06-17.