SB20260902108 - Multiple vulnerabilities in Erlang OTP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260902108

SB20260902108 - Multiple vulnerabilities in Erlang OTP

Published: September 2, 2026

Security Bulletin ID SB20260902108
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 25% Medium 63% Low 13%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Improper handling of exceptional conditions (CVE-ID: CVE-2026-42792)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in the do_accept function in erts/epmd/src/epmd_srv.c when handling TCP connection attempts after file descriptor exhaustion. A remote attacker can hold many TCP connections open and trigger accept(2) to return EMFILE or ENFILE to cause a denial of service.

The issue is feasible from a single source because epmd has no per-source-IP connection cap.


2) Relative Path Traversal (CVE-ID: CVE-2026-47078)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write arbitrary files outside the intended extraction directory.

The vulnerability exists due to relative path traversal in zip:unzip and zip:extract when processing a crafted zip archive. A remote attacker can supply a specially crafted zip archive to write arbitrary files outside the intended extraction directory.

User interaction is required to open or process the crafted archive.


3) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-55737)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to signed to unsigned conversion error in LARGE_TUPLE_EXT decoding in binary_to_term/1 when parsing untrusted external term format data. A remote attacker can supply a specially crafted binary term to cause a denial of service.

The issue affects the Erlang runtime functions decoded_size() and dec_term() in external.c.


4) Algorithm Downgrade (CVE-ID: CVE-2026-55953)

CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read and modify data transmitted over the connection.

The vulnerability exists due to selection of a less-secure algorithm during negotiation in the OTP TLS/DTLS client cipher suite validation logic when processing a ServerHello message. A remote attacker can select an anonymous cipher suite that was not offered by the client to read and modify data transmitted over the connection.

This affects TLS versions up to 1.2 and all DTLS versions, while TLS-1.3 connections are not affected. The issue can bypass the client\'s verify_peer setting because anonymous cipher suites do not require a server certificate.


5) Out-of-bounds write (CVE-ID: CVE-2026-59250)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the megaco flex scanner C linked-in driver when parsing a text-encoded H.248/Megaco message containing an oversized property parm name. A remote attacker can send a specially crafted message to cause a denial of service.

Only systems configured to use the megaco text codec with the flex scanner option are vulnerable, and the megaco transport port must be reachable. On some environments without runtime hardening, the memory corruption may enable arbitrary code execution.


6) Uncontrolled Recursion (CVE-ID: CVE-2026-58227)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in certificate chain path building when processing peer certificate messages during a partial TLS or DTLS handshake. A remote attacker can send a certificate chain containing two mutually cross-signed certificates in unordered form to cause a denial of service.

No authentication or completed handshake is required, and both client and server sides are affected.


7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59251)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in certificate path validation when processing a crafted certificate chain during the TLS handshake. A remote attacker can send a specially crafted certificate chain to cause a denial of service.

Any application using TLS certificate path validation through the ssl functionality or direct calls to public_key:pkix_path_validation/3 is affected.


8) Integer underflow (CVE-ID: CVE-2026-54890)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer underflow in the ETF decoder in binary_to_term/1,2 and enif_binary_to_term() when parsing a crafted BIT_BINARY_EXT input. A remote attacker can send a specially crafted payload to cause a denial of service.

The issue causes a full BEAM virtual machine crash rather than a process-level exception, and the [safe] option to binary_to_term/2 does not prevent it.


Remediation

Install update from vendor's website.

References