Every CVE Search/ Get API key

CVE-2026-54890

BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

8.2 HighFix available

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.

The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".

The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).

Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).

This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.42%Up 0.1 points since Jul 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.2

BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.

The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".

The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).

Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).

This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Record
CVE-2026-54890
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-191, CWE-789, CWE-1284
Updated
2026-11-02
EUVDEUVD-2026-49326 8.2

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.

The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".

The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).

Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).

This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Record
EUVD-2026-49326
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.2

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.

The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".

The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).

Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).

This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Record
CVE-2026-54890
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-191, CWE-789, CWE-1284
Updated
2026-11-02
OSV 8.2

BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.

The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".

The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).

Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).

This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Record
CVE-2026-54890
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-1284, CWE-191, CWE-789
Updated
2026-11-02
OSVDEBIAN-CVE-2026-54890 7.5

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)". The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings). Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Record
DEBIAN-CVE-2026-54890
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVEEF-CVE-2026-54890 8.2

BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

Summary

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.

The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".

The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).

Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).

This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Workarounds

Do not call binary_to_term/1,2 or enif_binary_to_term() on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.

Record
EEF-CVE-2026-54890
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-191, CWE-789, CWE-1284
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2026:47009 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:47009
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-54890 8.2

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)". The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings). Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Record
UBUNTU-CVE-2026-54890
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:11559-1 No score

erlang-28.5.0.4-1.1 on GA media

These are all security issues fixed in the erlang-28.5.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11559-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11560-1 No score

erlang27-27.1.3-3.1 on GA media

These are all security issues fixed in the erlang27-27.1.3-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11560-1
Updated
2026-11-02
OSVUSN-8827-1 No score

erlang vulnerabilities

It was discovered that the Erlang Port Mapper Daemon did not properly handle slow connections. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-42792)

It was discovered that Erlang incorrectly handled certain external term format data, leading to heap corruption. An attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-55737)

It was discovered that Erlang incorrectly handled invalid external term format data. An attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-54890)

It was discovered that Erlang incorrectly handled certain packet lengths, leading to a buffer overflow. A remote attacker could possibly use this issue to cause Erlang to crash or execute arbitrary code. (CVE-2026-75538)

It was discovered that the Erlang Megaco flex scanner incorrectly handled certain input, leading to a buffer overflow. A remote attacker could possibly use this issue to cause Erlang to crash or execute arbitrary code. (CVE-2026-59250)

It was discovered that Erlang TLS clients incorrectly accepted cipher suites that they had not offered. A remote attacker could possibly use this issue to intercept and modify TLS communications. (CVE-2026-55953)

It was discovered that Erlang incorrectly handled certain certificate chains. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-58227)

It was discovered that Erlang incorrectly handled certain certificate policies. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59251)

It was discovered that the Erlang HTTP server incorrectly handled certain conflicting HTTP framing headers. A remote attacker could possibly use this issue to smuggle HTTP requests. (CVE-2026-23941, CVE-2026-73812)

It was discovered that the Erlang HTTP server incorrectly handled certain malformed chunk sizes. A remote attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. (CVE-2026-69664)

It was discovered that the Erlang HTTP server did not properly limit the size of chunked request bodies. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. (CVE-2026-74835)

It was discovered that the Erlang HTTP server incorrectly handled certain equivalent request paths and differences in character case. A remote attacker could possibly use this issue to bypass authentication and gain unauthorized access. (CVE-2026-66835, CVE-2026-73270)

It was discovered that the Erlang HTTP server did not properly limit simultaneous connections. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-70399)

It was discovered that the Erlang HTTP server incorrectly handled header continuation lines. A remote attacker could possibly use this issue to smuggle HTTP requests. (CVE-2026-66357)

It was discovered that the Erlang HTTP server incorrectly handled certain malformed header names. A remote attacker could possibly use this issue to smuggle HTTP requests. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-73276)

It was discovered that the Erlang HTTP server incorrectly handled incomplete request bodies. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of…

Record
USN-8827-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
erlang
Debian:12
 All versions, plus listed versions
1:25.2.3+dfsg-11:25.2.3+dfsg-1+deb12u11:25.2.3+dfsg-1+deb12u21:25.2.3+dfsg-1+deb12u31:25.2.3+dfsg-1+deb12u4
Show 45 moreShow less
1:25.3.2.10+dfsg-11:25.3.2.10+dfsg-21:25.3.2.11+dfsg-11:25.3.2.12+dfsg-11:25.3.2.12+dfsg-21:25.3.2.12+dfsg-31:25.3.2.8+dfsg-11:26.0+dfsg-11:26.0.1+dfsg-11:26.0.2+dfsg-11:26.0~rc2+dfsg-11:26.0~rc3+dfsg-11:26.1.2+dfsg-11:26.2.1+dfsg-11:26.2.4+dfsg-11:27.0+dfsg-11:27.0.1+dfsg-11:27.0.1+dfsg-21:27.0.1+dfsg-31:27.0~rc3+dfsg-11:27.0~rc3+dfsg-21:27.0~rc3+dfsg-31:27.0~rc3+dfsg-41:27.1.2+dfsg-11:27.2+dfsg-11:27.2+dfsg-21:27.2+dfsg-3~exp11:27.2.1+dfsg-11:27.2.1+dfsg-21:27.2.2+dfsg-11:27.2.3+dfsg-11:27.2.4+dfsg-11:27.3+dfsg-11:27.3.1+dfsg-11:27.3.2+dfsg-11:27.3.3+dfsg-11:27.3.4+dfsg-11:27.3.4.1+dfsg-11:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-31:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-6
 None known
erlang
Debian:13
 before 1:27.3.4.1+dfsg-1+deb13u3, plus listed versions
1:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1+deb13u11:27.3.4.1+dfsg-1+deb13u2
1:27.3.4.1+dfsg-1+deb13u3
erlang
Debian:14
 before 1:29.0.4+dfsg-1, plus listed versions
1:27.3.4.1+dfsg-11:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-3
Show 30 moreShow less
1:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-61:27.3.4.11+dfsg-71:27.3.4.12+dfsg-11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.8+dfsg-11:27.3.4.9+dfsg-11:28.0+dfsg-11:28.0.1+dfsg-11:28.0.2+dfsg-11:28.0.4+dfsg-11:28.1.1+dfsg-11:28.2+dfsg-11:28.3+dfsg-11:28.3.1+dfsg-11:29.0+dfsg-11:29.0+dfsg-21:29.0.1+dfsg-11:29.0.2+dfsg-11:29.0.3+dfsg-11:29.0~rc1+dfsg-11:29.0~rc1+dfsg-21:29.0~rc2+dfsg-11:29.0~rc3+dfsg-11:29.0~rc3+dfsg-21:29.0~rc3+dfsg-31:29.0~rc3+dfsg-4
1:29.0.4+dfsg-1
erlang27
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-asn1
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-common_test
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-compiler
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-crypto
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-debugger
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-dialyzer
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
Show 42 moreShow less
Affected packages
PackageAffectedFixed
erlang27-diameter
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-edoc
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-eldap
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-erl_interface
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-erts
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-et
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-eunit
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-examples
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-ftp
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-gdb-tools
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-inets
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-jinterface
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-kernel
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-megaco
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-mnesia
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-observer
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-odbc
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-os_mon
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-parsetools
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-public_key
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-reltool
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-runtime_tools
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-sasl
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-snmp
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-ssh
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-ssl
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-stdlib
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-syntax_tools
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-tftp
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-tools
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-wx
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang27-xmerl
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:27.3.4.15-0.1.hum1
0:27.3.4.15-0.1.hum1
erlang
Ubuntu:26.04:LTS
 before 1:27.3.4.6+dfsg-1ubuntu0.1, plus listed versions
1:27.3.4.1+dfsg-1build11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-1
1:27.3.4.6+dfsg-1ubuntu0.1
erlang
Ubuntu:Pro:14.04:LTS
From an advisory covering 19 CVEs
 before 1:16.b.3-dfsg-1ubuntu2.2+esm2, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu21:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.21:16.b.3-dfsg-1ubuntu2.2+esm1
1:16.b.3-dfsg-1ubuntu2.2+esm2
erlang
Ubuntu:Pro:16.04:LTS
From an advisory covering 19 CVEs
 before 1:18.3-dfsg-1ubuntu3.1+esm3, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu2
Show 4 moreShow less
1:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm11:18.3-dfsg-1ubuntu3.1+esm2
1:18.3-dfsg-1ubuntu3.1+esm3
erlang
Ubuntu:Pro:18.04:LTS
From an advisory covering 19 CVEs
 before 1:20.2.2+dfsg-1ubuntu2+esm3, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 7 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm11:20.2.2+dfsg-1ubuntu2+esm2
1:20.2.2+dfsg-1ubuntu2+esm3
erlang
Ubuntu:Pro:20.04:LTS
From an advisory covering 19 CVEs
 before 1:22.2.7+dfsg-1ubuntu0.5+esm2, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 8 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.51:22.2.7+dfsg-1ubuntu0.5+esm1
1:22.2.7+dfsg-1ubuntu0.5+esm2
erlang
Ubuntu:22.04:LTS
From an advisory covering 19 CVEs
 before 1:24.2.1+dfsg-1ubuntu0.7, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 8 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.51:24.2.1+dfsg-1ubuntu0.6
1:24.2.1+dfsg-1ubuntu0.7
erlang
Ubuntu:24.04:LTS
From an advisory covering 19 CVEs
 before 1:25.3.2.8+dfsg-1ubuntu4.7, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 6 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.41:25.3.2.8+dfsg-1ubuntu4.51:25.3.2.8+dfsg-1ubuntu4.6
1:25.3.2.8+dfsg-1ubuntu4.7
erlang
Ubuntu:26.04:LTS
From an advisory covering 19 CVEs
 before 1:27.3.4.6+dfsg-1ubuntu0.1, plus listed versions
1:27.3.4.1+dfsg-1build11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-1
1:27.3.4.6+dfsg-1ubuntu0.1
erlang
openSUSE:Tumbleweed
From an advisory covering 24 CVEs
 before 28.5.0.4-1.1
28.5.0.4-1.1
erlang27
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 27.1.3-3.1
27.1.3-3.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54890 is a high vulnerability (CVSS 8.2) in Erlang Erts, published July 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in erlang 1:27.3.4.1+dfsg-1+deb13u3.

References

Show 91 moreShow less
This page doesn't list everything

Left out here: 31 versions and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open