Observable Response Discrepancy in otp - CVE-2026-53422

Vulnerability identifier: #VU136828

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53422

CWE-ID: CWE-204

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to disclose sensitive information about filesystem path existence.

The vulnerability exists due to observable response discrepancy in the ssh_sftpd SSH_FXP_REALPATH handler when processing a crafted traversal path in a REALPATH request. A remote user can send a specially crafted REALPATH request to disclose sensitive information about filesystem path existence.

The issue affects deployments that rely on the configured root option for filesystem path isolation, and it does not by itself provide file contents disclosure or write access.

otp
openEuler
erlang-debuginfo
erlang-reltool
erlang-public_key
erlang-parsetools
erlang-os_mon
erlang-odbc
erlang-observer
erlang-mnesia
erlang-megaco
erlang-kernel
erlang
erlang-asn1
erlang-common_test
erlang-compiler
erlang-crypto
erlang-debugger
erlang-runtime_tools
erlang-debugsource
erlang-dialyzer
erlang-diameter
erlang-edoc
erlang-eldap
erlang-erl_docgen
erlang-erl_interface
erlang-erts
erlang-et
erlang-eunit
erlang-examples
erlang-ftp
erlang-hipe
erlang-inets
erlang-jinterface
erlang-sasl
erlang-xmerl
erlang-wx
erlang-tools
erlang-tftp
erlang-syntax_tools
erlang-stdlib
erlang-ssl
erlang-ssh
erlang-snmp
erlang-src

Install security update from vendor's website.

otp - addressed in versions 27.3.4.14, 28.5.0.3, 29.0.3
erlang-debuginfo - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-reltool - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-public_key - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-parsetools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-os_mon - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-odbc - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-observer - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-mnesia - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-megaco - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-kernel - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-asn1 - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-common_test - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-compiler - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-crypto - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-debugger - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-runtime_tools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-debugsource - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-dialyzer - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-diameter - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-edoc - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-eldap - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-erl_docgen - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-erl_interface - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-erts - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-et - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-eunit - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-examples - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-ftp - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-hipe - update to 23.3.4.9-11
erlang-inets - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-jinterface - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-sasl - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-xmerl - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-wx - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-tools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-tftp - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-syntax_tools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-stdlib - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-ssl - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-ssh - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-snmp - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-src - update to 25.3.2.6-18

• https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976

• Multiple vulnerabilities in otp
• openEuler 24.03 LTS SP1 update for erlang
• openEuler 22.03 LTS SP4 update for erlang
• openEuler 24.03 LTS SP4 update for erlang
• openEuler 24.03 LTS SP3 update for erlang