SB20260902109 - openEuler 24.03 LTS SP3 update for erlang
Published: September 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper handling of exceptional conditions (CVE-ID: CVE-2026-42792)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of exceptional conditions in the do_accept function in erts/epmd/src/epmd_srv.c when handling TCP connection attempts after file descriptor exhaustion. A remote attacker can hold many TCP connections open and trigger accept(2) to return EMFILE or ENFILE to cause a denial of service.
The issue is feasible from a single source because epmd has no per-source-IP connection cap.
2) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-55737)
CWE-ID: CWE-195 - Signed to Unsigned Conversion Error
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to signed to unsigned conversion error in LARGE_TUPLE_EXT decoding in binary_to_term/1 when parsing untrusted external term format data. A remote attacker can supply a specially crafted binary term to cause a denial of service.
The issue affects the Erlang runtime functions decoded_size() and dec_term() in external.c.
3) Algorithm Downgrade (CVE-ID: CVE-2026-55953)
CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read and modify data transmitted over the connection.
The vulnerability exists due to selection of a less-secure algorithm during negotiation in the OTP TLS/DTLS client cipher suite validation logic when processing a ServerHello message. A remote attacker can select an anonymous cipher suite that was not offered by the client to read and modify data transmitted over the connection.
This affects TLS versions up to 1.2 and all DTLS versions, while TLS-1.3 connections are not affected. The issue can bypass the client\'s verify_peer setting because anonymous cipher suites do not require a server certificate.
4) Uncontrolled Recursion (CVE-ID: CVE-2026-58227)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in certificate chain path building when processing peer certificate messages during a partial TLS or DTLS handshake. A remote attacker can send a certificate chain containing two mutually cross-signed certificates in unordered form to cause a denial of service.
No authentication or completed handshake is required, and both client and server sides are affected.
5) Out-of-bounds write (CVE-ID: CVE-2026-59250)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the megaco flex scanner C linked-in driver when parsing a text-encoded H.248/Megaco message containing an oversized property parm name. A remote attacker can send a specially crafted message to cause a denial of service.
Only systems configured to use the megaco text codec with the flex scanner option are vulnerable, and the megaco transport port must be reachable. On some environments without runtime hardening, the memory corruption may enable arbitrary code execution.
Remediation
Install update from vendor's website.