SB2026110251 - Fedora 44 update for erlang
Published: November 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-59696)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of specified quantity in input in stdlib integer conversion functions and uri_string:parse/1 when processing untrusted URL input or converting unbounded textual decimal representations and arbitrary-precision integers. A remote attacker can send a specially crafted input to cause a denial of service.
The render path performs integer string conversion inside a non-yielding C BIF, which can occupy a dirty scheduler thread for the full conversion, while the parse path is preemptible but can still consume significant processing time with extremely large inputs.
2) Improper Validation of Consistency within Input (CVE-ID: CVE-2026-94200)
CWE-ID: CWE-1288 - Improper Validation of Consistency within Input
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a node-wide denial of service affecting SSL functionality.
The vulnerability exists due to improper validation of consistency within input in the node-global tls_client_ticket_store when automatically resuming TLS 1.3 sessions. A remote attacker can supply a crafted NewSessionTicket containing zero-length early_data to cause a node-wide denial of service affecting SSL functionality.
Exploitation requires a connection to a malicious or man-in-the-middle TLS server and automatic ticket handling with {session_tickets, auto} enabled.
3) Improper Certificate Validation (CVE-ID: CVE-2026-105236)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass client certificate authentication for a protected SNI virtual host.
The vulnerability exists due to improper certificate validation in the Erlang/OTP ssl TLS 1.2 session resumption implementation when accepting session-ID resumptions across SNI virtual hosts. A remote attacker can resume a session established at a lower-trust SNI name at a higher-trust SNI name without the cached client certificate being validated against the higher-trust certificate authority to bypass client certificate authentication for a protected SNI virtual host.
Exploitation requires at least two SNI names on one listener sharing a server certificate but using distinct client certificate authorities, negotiated TLS 1.2, and enabled session reuse. A legitimate client certificate for the lower-trust SNI name is required, but no certificate trusted by the protected SNI name is needed. TLS 1.3 is not affected.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-75538)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow caused by signed integer overflow in the inet TCP driver when processing TCP packets in {packet,4} mode. A remote attacker can send a specially crafted packet with an incorrect length value to cause a denial of service.
Only TCP ports using the inet driver with {packet,4} mode are affected.
5) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-73270)
CWE-ID: CWE-178 - Improper Handling of Case Sensitivity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication and access protected resources.
The vulnerability exists due to improper handling of case sensitivity in the mod_auth module in OTP's inets httpd server when processing requests for protected directory paths on case-insensitive filesystems. A remote attacker can request the same protected resource using different path casing to bypass authentication and access protected resources.
Only deployments on case-insensitive filesystems such as Windows and macOS are vulnerable, and exploitation requires one or more directory blocks configured with mod_auth.
Remediation
Install update from vendor's website.