SB20260902113 - SUSE update for erlang

Description

This security bulletin contains information about 19 vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: CVE-2026-49760)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in ei_s_print_term when processing an encoded Erlang term containing a very large integer. A remote attacker can supply specially crafted term data to cause a denial of service.

The issue is limited to the memory-printing function and does not affect the related ei_print_term function that writes to a FILE.

2) Out-of-bounds write (CVE-ID: CVE-2026-59250)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the megaco flex scanner C linked-in driver when parsing a text-encoded H.248/Megaco message containing an oversized property parm name. A remote attacker can send a specially crafted message to cause a denial of service.

Only systems configured to use the megaco text codec with the flex scanner option are vulnerable, and the megaco transport port must be reachable. On some environments without runtime hardening, the memory corruption may enable arbitrary code execution.

3) Uncontrolled Recursion (CVE-ID: CVE-2026-58227)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in certificate chain path building when processing peer certificate messages during a partial TLS or DTLS handshake. A remote attacker can send a certificate chain containing two mutually cross-signed certificates in unordered form to cause a denial of service.

No authentication or completed handshake is required, and both client and server sides are affected.

4) Algorithm Downgrade (CVE-ID: CVE-2026-55953)

CWE-ID: CWE-757 - Selection of Less-Secure Algorithm During Negotiat

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read and modify data transmitted over the connection.

The vulnerability exists due to selection of a less-secure algorithm during negotiation in the OTP TLS/DTLS client cipher suite validation logic when processing a ServerHello message. A remote attacker can select an anonymous cipher suite that was not offered by the client to read and modify data transmitted over the connection.

This affects TLS versions up to 1.2 and all DTLS versions, while TLS-1.3 connections are not affected. The issue can bypass the client\'s verify_peer setting because anonymous cipher suites do not require a server certificate.

5) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-55952)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of specified quantity in input in the TLS-1.3 session ticket handler when processing a malformed ClientHello with mismatched PSK identity and binder list lengths. A remote attacker can send a specially crafted ClientHello message to cause a denial of service.

Only TLS-1.3 servers with session tickets enabled are vulnerable. TLS-1.2 connections are not affected.

6) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-55737)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to signed to unsigned conversion error in LARGE_TUPLE_EXT decoding in binary_to_term/1 when parsing untrusted external term format data. A remote attacker can supply a specially crafted binary term to cause a denial of service.

The issue affects the Erlang runtime functions decoded_size() and dec_term() in external.c.

7) Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CVE-ID: CVE-2026-54891)

CWE-ID: CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to inject plaintext data into a TLS client application.

The vulnerability exists due to improper enforcement of message integrity during transmission in the (d)tls client handshake handling when a man-in-the-middle interferes before the handshake completes. A remote attacker can inject plaintext data before handshake completion to inject plaintext data into a TLS client application.

The injected data may be delivered to the client application after a successful handshake. The injection window is smaller for TLS 1.3 than for earlier TLS versions.

8) Use of Default Cryptographic Key (CVE-ID: CVE-2026-54887)

CWE-ID: CWE-1394 - Use of Default Cryptographic Key

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass DTLS address verification.

The vulnerability exists due to use of a default cryptographic key in the DTLS cookie handling during server startup when processing a plaintext ClientHello before the first cookie secret rotation. A remote attacker can compute and submit a valid forged cookie to bypass DTLS address verification.

The issue is limited to the startup window before the first secret rotation, approximately 0 to 15 seconds, and requires observing the plaintext ClientHello contents.

9) Infinite loop (CVE-ID: CVE-2026-54886)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an infinite loop in handle_data/4 in ssh_sftpd.erl when processing SSH_MSG_CHANNEL_EXTENDED_DATA on an established SFTP channel. A remote user can send a specially crafted extended data message to cause a denial of service.

The issue affects targeted SFTP channel processes, which become permanently unresponsive while continuing to consume CPU time and accumulate unbounded message queue memory. Opening many channels can amplify the impact.

10) Observable Response Discrepancy (CVE-ID: CVE-2026-53422)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information about filesystem path existence.

The vulnerability exists due to observable response discrepancy in the ssh_sftpd SSH_FXP_REALPATH handler when processing a crafted traversal path in a REALPATH request. A remote user can send a specially crafted REALPATH request to disclose sensitive information about filesystem path existence.

The issue affects deployments that rely on the configured root option for filesystem path isolation, and it does not by itself provide file contents disclosure or write access.

11) Generation of Predictable Numbers or Identifiers (CVE-ID: CVE-2026-28810)

CWE-ID: CWE-340 - Generation of Predictable Numbers or Identifiers

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to poison the DNS cache.

The vulnerability exists due to generation of predictable numbers or identifiers in the inet_res built-in DNS resolver when processing UDP DNS queries. A remote attacker can forge a DNS response with a predicted transaction ID to poison the DNS cache.

Exploitation is practical for an attacker who can observe one query or predict the next transaction ID.

12) Stack-based buffer overflow (CVE-ID: CVE-2026-49759)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in SCTP error cause parsing in inet_drv.c when processing a crafted SCTP ERROR chunk. A remote attacker can send a specially crafted SCTP ERROR chunk after establishing an SCTP association to cause a denial of service.

Systems are affected only when SCTP support is enabled, a listening SCTP socket is opened via gen_sctp with the default inet backend, and the listening port is reachable from the attacker's network.

13) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-48858)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to perform server-side request forgery against internal or third-party hosts.

The vulnerability exists due to improper control of a resource through its lifetime in ftp_internal:handle_command/3 when processing PASV responses in passive mode. A remote user can supply a crafted 227 response with an arbitrary IP address and port to perform server-side request forgery against internal or third-party hosts.

On affected operations, the client may read data from or send data to the redirected target instead of the FTP server. The issue affects the PASV path used with the default passive-mode configuration and does not affect the EPSV path.

14) Open redirect (CVE-ID: CVE-2026-48856)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the httpc redirect handler in httpc_response.erl when processing cross-origin redirects. A remote attacker can cause a server contacted by the victim to return a crafted redirect to disclose sensitive information.

By default, automatic redirects are enabled. The issue affects both the Authorization and proxy-authorization headers, including Basic credentials derived from URL userinfo.

15) Information disclosure (CVE-ID: CVE-2026-48855)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the SSH_FXP_READLINK handler in ssh_sftpd when reading symlink targets. A remote user can create a symlink and read it back via SFTP to disclose sensitive information.

Only configurations that use the SFTP root option are affected. The issue discloses absolute backend filesystem paths for the configured SFTP root directory and symlink targets within it, but does not by itself provide file contents or access outside the configured root.

16) Relative Path Traversal (CVE-ID: CVE-2026-47078)

CWE-ID: CWE-23 - Relative Path Traversal

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write arbitrary files outside the intended extraction directory.

The vulnerability exists due to relative path traversal in zip:unzip and zip:extract when processing a crafted zip archive. A remote attacker can supply a specially crafted zip archive to write arbitrary files outside the intended extraction directory.

User interaction is required to open or process the crafted archive.

17) Improper handling of exceptional conditions (CVE-ID: CVE-2026-42792)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in the do_accept function in erts/epmd/src/epmd_srv.c when handling TCP connection attempts after file descriptor exhaustion. A remote attacker can hold many TCP connections open and trigger accept(2) to return EMFILE or ENFILE to cause a denial of service.

The issue is feasible from a single source because epmd has no per-source-IP connection cap.

18) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-42790)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certificate hostname validation.

The vulnerability exists due to improper validation of certificate with host mismatch in public_key:pkix_verify_hostname/3 when processing TLS certificates that lack a Subject Alternative Name extension or contain no domain name in that extension. A remote attacker can present a specially crafted certificate during a man-in-the-middle position to bypass certificate hostname validation.

Exploitation requires the ability to intercept network traffic and, in the worst case, control a DNS-constrained sub-CA key.

19) Improper Certificate Validation (CVE-ID: CVE-2026-42789)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to spoof arbitrary certificate identities.

The vulnerability exists due to improper certificate validation in public_key:pkix_path_validation/3 when validating certificate chains. A remote user can use a non-CA end-entity certificate and its private key to forge leaf certificates for arbitrary identities to spoof arbitrary certificate identities.

Exploitation requires possession of an end-entity certificate issued by a CA in the victim's trust store where basicConstraints is set to cA:false and the keyUsage extension is absent.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2026/suse-su-20263645-1/