CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3.

These are all security issues fixed in the erlang-28.5.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the erlang27-27.1.3-3.1 package on the GA media of openSUSE Tumbleweed.

This update for erlang26 fixes the following issues:

• CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42792: permanent epmd DoS via connection slot exhaustion due to improper handling of exceptional conditions (bsc#1272908).
• CVE-2026-47078: relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass (bsc#1272909).
• CVE-2026-48855: SFTP READLINK response leaks absolute backend filesystem path when root is configured (bsc#1268139).
• CVE-2026-48856: httpc leaks Authorization headers to cross-origin redirect targets (bsc#1268141).
• CVE-2026-48858: server-side request forgery allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address (bsc#1268142).
• CVE-2026-48860: ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist (bsc#1268146).
• CVE-2026-49759: unbounded stack buffer overflow in SCTP error cause parsing in inet_drv (bsc#1268163).
• CVE-2026-49760: stack buffer overflow in ei_s_print_term at very large integer (bsc#1268164).
• CVE-2026-53422: SFTP REALPATH path-existence oracle allows filesystem enumeration outside configured root (bsc#1270245).
• CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop (bsc#1270246).
• CVE-2026-54887: use of default cryptographic key allows predictable DTLS cookie computation during the startup window (bsc#1270247).
• CVE-2026-54891: plaintext injection towards (D)TLS client during handshake (bsc#1270250).
• CVE-2026-55737: heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXTP decoding in erts external term format decoder (bsc#1272910).
• CVE-2026-55950: time-of-check time-of-use race condition allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener (bsc#1270253).
• CVE-2026-55952: missing validation allows for DoS of the TLS-1.3 server when clients send a malformed ClientHello with mismatched PSK identity and binder list lengths (bsc#1270258).
• CVE-2026-55953: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server authentication bypass (bsc#1272911).
• CVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (bsc#1272913).
• CVE-2026-59250: megaco flex scanner buffer overflow via oversized property parm name (bsc#1272914).
• CVE-2026-59251: denial of service via exponential certificate policy tree growth in path validation (bsc#1272915).

This update for erlang fixes the following issues:

• CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42792: permanent epmd DoS via connection slot exhaustion due to improper handling of exceptional conditions (bsc#1272908).
• CVE-2026-47078: relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass (bsc#1272909).
• CVE-2026-48855: SFTP READLINK response leaks absolute backend filesystem path when root is configured (bsc#1268139).
• CVE-2026-48856: httpc leaks Authorization headers to cross-origin redirect targets (bsc#1268141).
• CVE-2026-48858: server-side request forgery allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address (bsc#1268142).
• CVE-2026-49759: unbounded stack buffer overflow in SCTP error cause parsing in inet_drv (bsc#1268163).
• CVE-2026-49760: stack buffer overflow in ei_s_print_term at very large integer (bsc#1268164).
• CVE-2026-53422: SFTP REALPATH path-existence oracle allows filesystem enumeration outside configured root (bsc#1270245).
• CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop (bsc#1270246).
• CVE-2026-54887: use of default cryptographic key allows predictable DTLS cookie computation during the startup window (bsc#1270247).
• CVE-2026-54891: plaintext injection towards (D)TLS client during handshake (bsc#1270250).
• CVE-2026-55737: heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXTP decoding in erts external term format decoder (bsc#1272910).
• CVE-2026-55952: missing validation allows for DoS of the TLS-1.3 server when clients send a malformed ClientHello with mismatched PSK identity and binder list lengths (bsc#1270258).
• CVE-2026-55953: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server authentication bypass (bsc#1272911).
• CVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (bsc#1272913).
• CVE-2026-59250: megaco flex scanner buffer overflow via oversized property parm name (bsc#1272914).

Wander Nauta discovered that Erlang incorrectly handled absolute paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-4748)

It was discovered that the Erlang SFTP server did not properly limit the size of packets. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-26618)

It was discovered that the Erlang SSH server did not properly limit the length of algorithm names in key exchange messages. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-30211)

It was discovered that the Erlang TFTP server incorrectly handled certain file paths. A remote attacker could possibly use this issue to access files outside of the intended directory. (CVE-2026-21620)

It was discovered that the Erlang SFTP server incorrectly validated paths against the configured root directory. An authenticated user could possibly use this issue to access files outside of the root directory. (CVE-2026-23942)

It was discovered that the Erlang SSH server enabled zlib compression by default and did not limit the size of decompressed data. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. (CVE-2026-23943)

It was discovered that the Erlang HTTP server incorrectly applied directory access controls to CGI scripts served via script aliases. A remote attacker could possibly use this issue to bypass authentication and access protected CGI scripts. (CVE-2026-28808)

It was discovered that the Erlang DNS resolver used predictable transaction IDs and did not randomize source ports. A remote attacker could possibly use this issue to perform DNS cache poisoning attacks. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-28810)

It was discovered that Erlang did not verify the signatures of designated OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses and bypass certificate revocation checks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32144)

It was discovered that the Erlang SFTP server incorrectly handled file attribute changes on open file handles. An authenticated user could possibly use this issue to modify the attributes of files outside of the root directory. (CVE-2026-32147)

It was discovered that Erlang incorrectly allowed non-CA certificates to act as intermediate certificate issuers. A remote attacker could possibly use this issue to forge certificate chains. (CVE-2026-42789)

It was discovered that Erlang incorrectly handled DNS name constraints during hostname verification. A remote attacker could possibly use this issue to bypass certificate validation. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42790)

It was discovered that Erlang did not check the validity period of OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses using an expired responder certificate. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-42791)

It was discovered that Erlang incorrectly handled relative paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-47078)

It was discovered that the Erlang SFTP server exposed absolute paths when reading symbolic links. An…