Summary

  • Alistair Woodman projected more than 500 CVEs for the Erlang, Elixir and Gleam ecosystem in 2026, up from about 10 the year before; the RIPE 93 talk page reports a rise exceeding 50 times.
  • The bottleneck is now case handling and verified fixes. Woodman described batching work for maintainers and asked companies that use the ecosystem to help fund the CNA.

Ten CVEs last year. More than 500 expected this year. That is the scale Woodman put on the Erlang, Elixir and Gleam ecosystem at RIPE 93. The session page says the EEF’s CVE load rose by more than 50 times; in the transcript he gives the comparison and says the issues were already there, waiting to be found. It is a count of CVE records, not a count of new bugs or fixes shipped.

The number that matters next is smaller: five. Woodman said the CNA team had five principals. He described four other people on the list as community members and estimated that about 15 Ericsson staff actively maintain the core virtual machine. Two people do most of the CNA’s CVE handling and AI research. Those roles are not interchangeable. A CNA can coordinate a disclosure and assign an identifier; the package maintainer still has to reproduce the flaw, change code, test the patch and release it.

Woodman’s response is to stop treating every finding as a fresh interruption. He said the team is experimenting with asking one project to reserve time, then sending it a batch of findings to work through. It is a sensible attempt to give maintainers a bounded window. He did not present evidence that batching has shortened patch times, and every project still needs its own people.

The EEF’s published policy gives the coordinator a two-business-day target to acknowledge and assess a report. Publicly disclosed vulnerabilities are to be published within 24 hours or less. Those promises put staffing inside the security story: faster discovery creates more incoming cases, while the next decision often belongs to a maintainer outside the CNA.

Woodman estimated roughly 20,000 packages, around 100,000 people who use the languages regularly and at least 5,000 known corporate users. He closed by asking companies that use the software but are not on the sponsor list to help pay. The EEF’s coordinator page offers two routes: financial sponsorship or volunteer coordinators. A number can enter a database in minutes; a safe release still needs someone’s time.

Sources