SB20260902104 - Debian update for erlang
Published: September 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 27 vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2026-49759)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to stack-based buffer overflow in SCTP error cause parsing in inet_drv.c when processing a crafted SCTP ERROR chunk. A remote attacker can send a specially crafted SCTP ERROR chunk after establishing an SCTP association to cause a denial of service.
Systems are affected only when SCTP support is enabled, a listening SCTP socket is opened via gen_sctp with the default inet backend, and the listening port is reachable from the attacker's network.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59251)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in certificate path validation when processing a crafted certificate chain during the TLS handshake. A remote attacker can send a specially crafted certificate chain to cause a denial of service.
Any application using TLS certificate path validation through the ssl functionality or direct calls to public_key:pkix_path_validation/3 is affected.
3) Out-of-bounds write (CVE-ID: CVE-2026-59250)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the megaco flex scanner C linked-in driver when parsing a text-encoded H.248/Megaco message containing an oversized property parm name. A remote attacker can send a specially crafted message to cause a denial of service.
Only systems configured to use the megaco text codec with the flex scanner option are vulnerable, and the megaco transport port must be reachable. On some environments without runtime hardening, the memory corruption may enable arbitrary code execution.
4) Uncontrolled Recursion (CVE-ID: CVE-2026-58227)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in certificate chain path building when processing peer certificate messages during a partial TLS or DTLS handshake. A remote attacker can send a certificate chain containing two mutually cross-signed certificates in unordered form to cause a denial of service.
No authentication or completed handshake is required, and both client and server sides are affected.
5) Algorithm Downgrade (CVE-ID: CVE-2026-55953)
CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read and modify data transmitted over the connection.
The vulnerability exists due to selection of a less-secure algorithm during negotiation in the OTP TLS/DTLS client cipher suite validation logic when processing a ServerHello message. A remote attacker can select an anonymous cipher suite that was not offered by the client to read and modify data transmitted over the connection.
This affects TLS versions up to 1.2 and all DTLS versions, while TLS-1.3 connections are not affected. The issue can bypass the client\'s verify_peer setting because anonymous cipher suites do not require a server certificate.
6) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-55952)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of specified quantity in input in the TLS-1.3 session ticket handler when processing a malformed ClientHello with mismatched PSK identity and binder list lengths. A remote attacker can send a specially crafted ClientHello message to cause a denial of service.
Only TLS-1.3 servers with session tickets enabled are vulnerable. TLS-1.2 connections are not affected.
7) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-55950)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a time-of-check time-of-use race condition in the dtls_packet_demux gen_server process when handling rapid DTLS client reconnects from the same source address and port. A remote attacker can send multiple valid ClientHello datagrams in quick succession to cause a denial of service.
The crash of the shared demultiplexing process terminates all active DTLS sessions on the affected listener, and no completed handshake or credentials are required.
8) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-55737)
CWE-ID: CWE-195 - Signed to Unsigned Conversion Error
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to signed to unsigned conversion error in LARGE_TUPLE_EXT decoding in binary_to_term/1 when parsing untrusted external term format data. A remote attacker can supply a specially crafted binary term to cause a denial of service.
The issue affects the Erlang runtime functions decoded_size() and dec_term() in external.c.
CWE-ID: CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject plaintext data into a TLS client application.
The vulnerability exists due to improper enforcement of message integrity during transmission in the (d)tls client handshake handling when a man-in-the-middle interferes before the handshake completes. A remote attacker can inject plaintext data before handshake completion to inject plaintext data into a TLS client application.
The injected data may be delivered to the client application after a successful handshake. The injection window is smaller for TLS 1.3 than for earlier TLS versions.
10) Integer underflow (CVE-ID: CVE-2026-54890)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer underflow in the ETF decoder in binary_to_term/1,2 and enif_binary_to_term() when parsing a crafted BIT_BINARY_EXT input. A remote attacker can send a specially crafted payload to cause a denial of service.
The issue causes a full BEAM virtual machine crash rather than a process-level exception, and the [safe] option to binary_to_term/2 does not prevent it.
11) Use of Default Cryptographic Key (CVE-ID: CVE-2026-54887)
CWE-ID: CWE-1394 - Use of Default Cryptographic Key
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass DTLS address verification.
The vulnerability exists due to use of a default cryptographic key in the DTLS cookie handling during server startup when processing a plaintext ClientHello before the first cookie secret rotation. A remote attacker can compute and submit a valid forged cookie to bypass DTLS address verification.
The issue is limited to the startup window before the first secret rotation, approximately 0 to 15 seconds, and requires observing the plaintext ClientHello contents.
12) Infinite loop (CVE-ID: CVE-2026-54886)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an infinite loop in handle_data/4 in ssh_sftpd.erl when processing SSH_MSG_CHANNEL_EXTENDED_DATA on an established SFTP channel. A remote user can send a specially crafted extended data message to cause a denial of service.
The issue affects targeted SFTP channel processes, which become permanently unresponsive while continuing to consume CPU time and accumulate unbounded message queue memory. Opening many channels can amplify the impact.
13) Observable Response Discrepancy (CVE-ID: CVE-2026-53422)
CWE-ID: CWE-204 - Observable Response Discrepancy
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information about filesystem path existence.
The vulnerability exists due to observable response discrepancy in the ssh_sftpd SSH_FXP_REALPATH handler when processing a crafted traversal path in a REALPATH request. A remote user can send a specially crafted REALPATH request to disclose sensitive information about filesystem path existence.
The issue affects deployments that rely on the configured root option for filesystem path isolation, and it does not by itself provide file contents disclosure or write access.
14) Stack-based buffer overflow (CVE-ID: CVE-2026-49760)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to stack-based buffer overflow in ei_s_print_term when processing an encoded Erlang term containing a very large integer. A remote attacker can supply specially crafted term data to cause a denial of service.
The issue is limited to the memory-printing function and does not affect the related ei_print_term function that writes to a FILE.
15) Incorrect authorization (CVE-ID: CVE-2026-28808)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authorization checks and access protected CGI scripts.
The vulnerability exists due to incorrect authorization in mod_auth and mod_cgi path resolution when handling requests to script_alias CGI targets located outside DocumentRoot. A remote attacker can send a request to a script_alias URL to bypass authorization checks and access protected CGI scripts.
Exploitation requires script_alias to map a URL prefix to a CGI directory outside DocumentRoot while directory-based access controls are configured to protect that external directory.
16) Comparison using wrong factors (CVE-ID: CVE-2026-48860)
CWE-ID: CWE-1025 - Comparison using wrong factors
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass LAN-based access restrictions for Erlang distribution over TLS.
The vulnerability exists due to comparison using wrong factors in check_ip/1 in lib/ssl/src/inet_tls_dist.erl when validating the peer address for TLS distribution connections. A remote user can present a valid certificate signed by a shared trusted CA to bypass LAN-based access restrictions for Erlang distribution over TLS.
Exploitation requires Erlang distribution to use TLS with the kernel check_ip setting enabled, and the TLS trust model must accept certificates from a CA that is not dedicated exclusively to cluster members.
17) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-48858)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform server-side request forgery against internal or third-party hosts.
The vulnerability exists due to improper control of a resource through its lifetime in ftp_internal:handle_command/3 when processing PASV responses in passive mode. A remote user can supply a crafted 227 response with an arbitrary IP address and port to perform server-side request forgery against internal or third-party hosts.
On affected operations, the client may read data from or send data to the redirected target instead of the FTP server. The issue affects the PASV path used with the default passive-mode configuration and does not affect the EPSV path.
18) Open redirect (CVE-ID: CVE-2026-48856)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in the httpc redirect handler in httpc_response.erl when processing cross-origin redirects. A remote attacker can cause a server contacted by the victim to return a crafted redirect to disclose sensitive information.
By default, automatic redirects are enabled. The issue affects both the Authorization and proxy-authorization headers, including Basic credentials derived from URL userinfo.
19) Information disclosure (CVE-ID: CVE-2026-48855)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the SSH_FXP_READLINK handler in ssh_sftpd when reading symlink targets. A remote user can create a symlink and read it back via SFTP to disclose sensitive information.
Only configurations that use the SFTP root option are affected. The issue discloses absolute backend filesystem paths for the configured SFTP root directory and symlink targets within it, but does not by itself provide file contents or access outside the configured root.
20) Relative Path Traversal (CVE-ID: CVE-2026-47078)
CWE-ID: CWE-23 - Relative Path Traversal
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write arbitrary files outside the intended extraction directory.
The vulnerability exists due to relative path traversal in zip:unzip and zip:extract when processing a crafted zip archive. A remote attacker can supply a specially crafted zip archive to write arbitrary files outside the intended extraction directory.
User interaction is required to open or process the crafted archive.
21) Improper handling of exceptional conditions (CVE-ID: CVE-2026-42792)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of exceptional conditions in the do_accept function in erts/epmd/src/epmd_srv.c when handling TCP connection attempts after file descriptor exhaustion. A remote attacker can hold many TCP connections open and trigger accept(2) to return EMFILE or ENFILE to cause a denial of service.
The issue is feasible from a single source because epmd has no per-source-IP connection cap.
22) Improper Certificate Validation (CVE-ID: CVE-2026-42791)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate revocation checks.
The vulnerability exists due to improper certificate validation in public_key OCSP response verification when processing OCSP responses. A remote attacker can present a forged OCSP response signed with the private key of an expired or not-yet-valid OCSP responder certificate to bypass certificate revocation checks.
This can affect SSL/TLS clients using OCSP stapling and applications that call public_key:pkix_ocsp_validate/5 directly. Exploitation requires possession of the private key of a legitimately issued OCSP responder certificate outside its validity period and the ability to deliver the forged OCSP response to the victim.
23) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-42790)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate hostname validation.
The vulnerability exists due to improper validation of certificate with host mismatch in public_key:pkix_verify_hostname/3 when processing TLS certificates that lack a Subject Alternative Name extension or contain no domain name in that extension. A remote attacker can present a specially crafted certificate during a man-in-the-middle position to bypass certificate hostname validation.
Exploitation requires the ability to intercept network traffic and, in the worst case, control a DNS-constrained sub-CA key.
24) Improper Certificate Validation (CVE-ID: CVE-2026-42789)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to spoof arbitrary certificate identities.
The vulnerability exists due to improper certificate validation in public_key:pkix_path_validation/3 when validating certificate chains. A remote user can use a non-CA end-entity certificate and its private key to forge leaf certificates for arbitrary identities to spoof arbitrary certificate identities.
Exploitation requires possession of an end-entity certificate issued by a CA in the victim's trust store where basicConstraints is set to cA:false and the keyUsage extension is absent.
25) Path traversal (CVE-ID: CVE-2026-32147)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify file attributes outside the intended chroot boundary.
The vulnerability exists due to path traversal in the ssh_sftpd SFTP daemon when handling SSH_FXP_FSETSTAT on file handles created from user-supplied paths. A remote user can create a corresponding path inside the chroot and issue a crafted SSH_FXP_FSETSTAT request to modify file attributes outside the intended chroot boundary.
Only servers configured with the root option are vulnerable, and the target file must already exist on the real filesystem. File contents cannot be read or modified through this issue.
26) Improper Certificate Validation (CVE-ID: CVE-2026-32144)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate-based authentication.
The vulnerability exists due to improper certificate validation in OCSP designated-responder authorization handling when validating OCSP responses. A remote attacker can provide a crafted OCSP response to bypass certificate-based authentication.
Exploitation requires control of, or a man-in-the-middle position over, the server being validated.
27) Generation of Predictable Numbers or Identifiers (CVE-ID: CVE-2026-28810)
CWE-ID: CWE-340 - Generation of Predictable Numbers or Identifiers
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the DNS cache.
The vulnerability exists due to generation of predictable numbers or identifiers in the inet_res built-in DNS resolver when processing UDP DNS queries. A remote attacker can forge a DNS response with a predicted transaction ID to poison the DNS cache.
Exploitation is practical for an attacker who can observe one query or predict the next transaction ID.
Remediation
Install update from vendor's website.