Comparison using wrong factors in Erlang OTP - CVE-2026-48860

Vulnerability identifier: #VU136819

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-48860

CWE-ID: CWE-1025

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass LAN-based access restrictions for Erlang distribution over TLS.

The vulnerability exists due to comparison using wrong factors in check_ip/1 in lib/ssl/src/inet_tls_dist.erl when validating the peer address for TLS distribution connections. A remote user can present a valid certificate signed by a shared trusted CA to bypass LAN-based access restrictions for Erlang distribution over TLS.

Exploitation requires Erlang distribution to use TLS with the kernel check_ip setting enabled, and the TLS trust model must accept certificates from a CA that is not dedicated exclusively to cluster members.

Erlang OTP
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
Fedora
PowerVC
erlang26-debugger-src
erlang26
erlang26-dialyzer
erlang26-observer
erlang26-debuginfo
erlang26-src
erlang26-observer-src
erlang26-wx-debuginfo
erlang26-diameter
erlang26-doc
erlang26-epmd-debuginfo
erlang26-debugsource
erlang26-dialyzer-debuginfo
erlang26-reltool
erlang26-reltool-src
erlang26-debugger
erlang26-et
erlang26-wx
erlang26-diameter-src
erlang26-dialyzer-src
erlang26-wx-src
erlang26-jinterface
erlang26-epmd
erlang26-jinterface-src
erlang26-et-src
erlang
erlang27-src
erlang27-dialyzer-debuginfo
erlang27-reltool-src
erlang27-dialyzer
erlang27-debuginfo
erlang27-diameter-src
erlang27-epmd
erlang27
erlang27-dialyzer-src
erlang27-debugsource
erlang27-reltool
erlang27-jinterface-src
erlang27-jinterface
erlang27-epmd-debuginfo
erlang27-diameter
erlang (Debian package)

Install security update from vendor's website.

Erlang OTP - addressed in versions 27.3.4.13, 28.5.0.2, 29.0.2
erlang26-debugger-src - update to 26.2.1-150300.7.28.1
erlang26 - update to 26.2.1-150300.7.28.1
erlang26-dialyzer - update to 26.2.1-150300.7.28.1
erlang26-observer - update to 26.2.1-150300.7.28.1
erlang26-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-src - update to 26.2.1-150300.7.28.1
erlang26-observer-src - update to 26.2.1-150300.7.28.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-diameter - update to 26.2.1-150300.7.28.1
erlang26-doc - update to 26.2.1-150300.7.28.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-debugsource - update to 26.2.1-150300.7.28.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-reltool - update to 26.2.1-150300.7.28.1
erlang26-reltool-src - update to 26.2.1-150300.7.28.1
erlang26-debugger - update to 26.2.1-150300.7.28.1
erlang26-et - update to 26.2.1-150300.7.28.1
erlang26-wx - update to 26.2.1-150300.7.28.1
erlang26-diameter-src - update to 26.2.1-150300.7.28.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.28.1
erlang26-wx-src - update to 26.2.1-150300.7.28.1
erlang26-jinterface - update to 26.2.1-150300.7.28.1
erlang26-epmd - update to 26.2.1-150300.7.28.1
erlang26-jinterface-src - update to 26.2.1-150300.7.28.1
erlang26-et-src - update to 26.2.1-150300.7.28.1
erlang - addressed in versions 26.2.5.21-4.fc43, 26.2.5.21-4.fc44
erlang27-src - update to 27.1.3-150300.7.7.1
erlang27-dialyzer-debuginfo - update to 27.1.3-150300.7.7.1
erlang27-reltool-src - update to 27.1.3-150300.7.7.1
erlang27-dialyzer - update to 27.1.3-150300.7.7.1
erlang27-debuginfo - update to 27.1.3-150300.7.7.1
erlang27-diameter-src - update to 27.1.3-150300.7.7.1
erlang27-epmd - update to 27.1.3-150300.7.7.1
erlang27 - update to 27.1.3-150300.7.7.1
erlang27-dialyzer-src - update to 27.1.3-150300.7.7.1
erlang27-debugsource - update to 27.1.3-150300.7.7.1
erlang27-reltool - update to 27.1.3-150300.7.7.1
erlang27-jinterface-src - update to 27.1.3-150300.7.7.1
erlang27-jinterface - update to 27.1.3-150300.7.7.1
erlang27-epmd-debuginfo - update to 27.1.3-150300.7.7.1
erlang27-diameter - update to 27.1.3-150300.7.7.1
erlang (Debian package) - update to 1:27.3.4.1+dfsg-1+deb13u3

• https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv

• Multiple vulnerabilities in otp
• Fedora 44 update for erlang
• Fedora 43 update for erlang
• Debian update for erlang
• SUSE update for erlang26
• SUSE update for erlang27
• Multiple vulnerabilities in IBM PowerVC