How many CVEs have patched init?

5 published CVEs changed init in erlang/otp, in 9 distinct patches totalling 21 changed lines, between 2011 and 2026.

What is the latest CVE that changed init?

CVE-2026-71380 (httpd applies no timeout while receiving a request body, parking a worker on a stalled client), published 2026-09-01, changed lines 122 of lib/inets/src/http_server/httpd_request_handler.erl.

How does init compare to the rest of erlang/otp?

erlang/otp has 58 CVEs with a located fix in total; 5 of them changed init.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

RadicalNotion.AI

Log in Create an account

erlang/otp

Function

3 files

init

Name: init in erlang/otp: CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Defined in 3 files

Last patched September 1, 2026

5

CVEs

That changed this function

9

Distinct patches

Backports counted once

21

Lines changed

Added plus removed

2011–2026

Years

By CVE publication date

Overview

init in erlang/otp was changed by 5 published CVE fixes between 2011 and 2026, in 9 distinct patches that added or removed 21 lines in total.

The name occurs in 3 files: lib/ssh/src/ssh_sftpd.erl, lib/inets/src/http_server/httpd_request_handler.erl, lib/ssh/src/ssh_connection_handler.erl.

erlang/otp has 58 CVEs with a located fix in total, so 9% of them touched this function.

CVEs that patched it

Every published CVE whose fix changed init, newest first, with the lines each fix touched.

httpd applies no timeout while receiving a request body, parking a worker on a stalled client
CVE-2026-71380 · lib/inets/src/http_server/httpd_request_handler.erl · line 122 · +1 −1
High · CVSS 8.7
EPSS 0.7%2026-09-01
SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
CVE-2025-48041 · lib/ssh/src/ssh_sftpd.erl · lines 161–166 · +5 −1
High · CVSS 7.1
EPSS 0.4%2025-09-11

Unverified Paths can Cause Excessive Use of System Resources

CVE-2025-48039 · lib/ssh/src/ssh_sftpd.erl · lines 159–164 · +5 −1

Medium · CVSS 5.3

EPSS 0.4%2025-09-11

SSH SFTP packet size not verified properly in Erlang OTP

CVE-2025-26618 · lib/ssh/src/ssh_sftpd.erl · lines 131–132 · +2 −3

High · CVSS 7.0

EPSS 0.5%2025-02-20

CVE-2011-0766

CVE-2011-0766 · lib/ssh/src/ssh_connection_handler.erl · line 109 · +0 −2

High · CVSS 7.8

EPSS 3.1%2011-05-31

Get an alert when the next CVE fix lands in erlang/otp, with the patched functions.

Monitor otp CVEs

Other functions in these files

Functions in the same files that CVE fixes also changed.

Other hotspots in the repository

Functions in erlang/otp changed by the most CVE fixes.

format3 CVEs · lib/ssh/src/ssh_connection_handler.erl xf_send_status3 CVEs · lib/ssh/src/ssh_sftpd.erl customize_headers3 CVEs · lib/inets/src/http_server/httpd_request.erl handle_data3 CVEs · lib/ssh/src/ssh_sftpd.erl send_status2 CVEs · lib/inets/src/http_server/httpd_request_handler.erl handle_msg2 CVEs · lib/ssh/src/ssh_connection.erl

All patched functions in erlang/otp

Frequently asked questions

Common questions about CVE fixes to init.

How many CVEs have patched init?: 5 published CVEs changed init in erlang/otp, in 9 distinct patches totalling 21 changed lines, between 2011 and 2026.
What is the latest CVE that changed init?: CVE-2026-71380 (httpd applies no timeout while receiving a request body, parking a worker on a stalled client), published 2026-09-01, changed lines 122 of lib/inets/src/http_server/httpd_request_handler.erl.
How does init compare to the rest of erlang/otp?: erlang/otp has 58 CVEs with a located fix in total; 5 of them changed init.
What do the line numbers refer to?: Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track erlang/otp CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing