CVE-2016-1000107 Server-side request forgery in n/a
Attackers can redirect outbound HTTP traffic to arbitrary proxies via crafted headers, bypassing security controls and potentially exposing data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-1000107?
CVE-2016-1000107 is a medium-severity server-side request forgery vulnerability in n/a, published on 10 Dec 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Weakness: CWE-601
Which versions are affected by CVE-2016-1000107?
It affects 1 product.
Linux distribution packages (1)
erlang openSUSE:Tumbleweed | All versions | 28.1.1-1.1 |
Products include Erlang Erlang\/Otp.
How do I fix CVE-2016-1000107?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2016-1000107 being exploited?
There is no known exploitation of CVE-2016-1000107 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-37026 Auth bypass in n/a
- CVE-2016-10253 Memory corruption in n/a
- CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
- CVE-2026-49759 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
- CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
Sources
Also known as DEBIAN-CVE-2016-1000107, GHSA-v875-g963-fhg4, UBUNTU-CVE-2016-1000107, openSUSE-SU-2025:15706-1.