{"id":"CVE-2026-23942","aliases":["AZL-79874","DEBIAN-CVE-2026-23942","EEF-CVE-2026-23942","EUVD-2026-11778","GHSA-4749-w85x-hw9h","OESA-2026-1665","OESA-2026-1666","OESA-2026-1667","OESA-2026-1668","OESA-2026-2704","SUSE-SU-2026:1714-1","SUSE-SU-2026:2010-1","SUSE-SU-2026:21374-1","UBUNTU-CVE-2026-23942","USN-8901-1","openSUSE-SU-2026:10947-1","openSUSE-SU-2026:20607-1"],"status":"published","title":"SFTP root escape via component-agnostic prefix check in ssh_sftpd","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00408,"percentile":0.35392,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-03-13T09:11:56Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Azure Linux:3","package":"erlang","fixed_in":["26.2.5.18-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"erlang","fixed_in":["1:25.2.3+dfsg-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"erlang","fixed_in":["1:27.3.4.1+dfsg-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"erlang","fixed_in":["1:27.3.4.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","fixed_in":["1:16.b.3-dfsg-1ubuntu2.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","fixed_in":["1:18.3-dfsg-1ubuntu3.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","fixed_in":["1:20.2.2+dfsg-1ubuntu2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","fixed_in":["1:22.2.7+dfsg-1ubuntu0.5+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"erlang","fixed_in":["1:24.2.1+dfsg-1ubuntu0.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"erlang","fixed_in":["1:25.3.2.8+dfsg-1ubuntu4.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"erlang","fixed_in":["1:27.3.4.6+dfsg-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.18-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.2.3+dfsg-1+deb12u4"}]}],"versions":["1:25.2.3+dfsg-1","1:25.2.3+dfsg-1+deb12u1","1:25.2.3+dfsg-1+deb12u2","1:25.2.3+dfsg-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.1+dfsg-1+deb13u2"}]}],"versions":["1:27.3.4.1+dfsg-1","1:27.3.4.1+dfsg-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.9+dfsg-1"}]}],"versions":["1:27.3.4.1+dfsg-1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1","1:27.3.4.8+dfsg-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-13.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-13.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-13.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-13.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.9-10.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2+esm3"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1","1:16.b.3-dfsg-1ubuntu2.2","1:16.b.3-dfsg-1ubuntu2.2+esm1","1:16.b.3-dfsg-1ubuntu2.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.3-dfsg-1ubuntu3.1+esm4"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3","1:18.3-dfsg-1ubuntu3.1","1:18.3-dfsg-1ubuntu3.1+esm1","1:18.3-dfsg-1ubuntu3.1+esm2","1:18.3-dfsg-1ubuntu3.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.2.2+dfsg-1ubuntu2+esm4"}]}],"versions":["1:20.0.4+dfsg-1ubuntu1","1:20.1.2+dfsg-1ubuntu1","1:20.1.3+dfsg-1ubuntu1","1:20.1.4+dfsg-1ubuntu1","1:20.1.5+dfsg-1ubuntu1","1:20.1.6+dfsg-1ubuntu1","1:20.1.7+dfsg-1ubuntu1","1:20.2.1+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu2","1:20.2.2+dfsg-1ubuntu2+esm1","1:20.2.2+dfsg-1ubuntu2+esm2","1:20.2.2+dfsg-1ubuntu2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1ubuntu0.5+esm3"}]}],"versions":["1:22.0.7+dfsg-1build1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1","1:22.2.7+dfsg-1ubuntu0.2","1:22.2.7+dfsg-1ubuntu0.3","1:22.2.7+dfsg-1ubuntu0.4","1:22.2.7+dfsg-1ubuntu0.5","1:22.2.7+dfsg-1ubuntu0.5+esm1","1:22.2.7+dfsg-1ubuntu0.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.2.1+dfsg-1ubuntu0.8"}]}],"versions":["1:23.2.6+dfsg-1build1","1:24.1.1+dfsg-1","1:24.1.4+dfsg-1","1:24.1.5+dfsg-1","1:24.1.5+dfsg-1ubuntu1","1:24.2+dfsg-1","1:24.2.1+dfsg-1","1:24.2.1+dfsg-1ubuntu0.1","1:24.2.1+dfsg-1ubuntu0.2","1:24.2.1+dfsg-1ubuntu0.3","1:24.2.1+dfsg-1ubuntu0.4","1:24.2.1+dfsg-1ubuntu0.5","1:24.2.1+dfsg-1ubuntu0.6","1:24.2.1+dfsg-1ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.3.2.8+dfsg-1ubuntu4.8"}]}],"versions":["1:25.2.3+dfsg-1","1:25.3.2.8+dfsg-1","1:25.3.2.8+dfsg-1ubuntu1","1:25.3.2.8+dfsg-1ubuntu3","1:25.3.2.8+dfsg-1ubuntu4","1:25.3.2.8+dfsg-1ubuntu4.1","1:25.3.2.8+dfsg-1ubuntu4.2","1:25.3.2.8+dfsg-1ubuntu4.3","1:25.3.2.8+dfsg-1ubuntu4.4","1:25.3.2.8+dfsg-1ubuntu4.5","1:25.3.2.8+dfsg-1ubuntu4.6","1:25.3.2.8+dfsg-1ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:27.3+dfsg-1ubuntu1","1:27.3+dfsg-1ubuntu1.1","1:27.3.4.1+dfsg-1","1:27.3.4.1+dfsg-1build1","1:27.3.4.1+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.6+dfsg-1ubuntu0.2"}]}],"versions":["1:27.3.4.1+dfsg-1build1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1","1:27.3.4.6+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2+esm3"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1","1:16.b.3-dfsg-1ubuntu2.2","1:16.b.3-dfsg-1ubuntu2.2+esm1","1:16.b.3-dfsg-1ubuntu2.2+esm2"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.3-dfsg-1ubuntu3.1+esm4"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3","1:18.3-dfsg-1ubuntu3.1","1:18.3-dfsg-1ubuntu3.1+esm1","1:18.3-dfsg-1ubuntu3.1+esm2","1:18.3-dfsg-1ubuntu3.1+esm3"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.2.2+dfsg-1ubuntu2+esm4"}]}],"versions":["1:20.0.4+dfsg-1ubuntu1","1:20.1.2+dfsg-1ubuntu1","1:20.1.3+dfsg-1ubuntu1","1:20.1.4+dfsg-1ubuntu1","1:20.1.5+dfsg-1ubuntu1","1:20.1.6+dfsg-1ubuntu1","1:20.1.7+dfsg-1ubuntu1","1:20.2.1+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu2","1:20.2.2+dfsg-1ubuntu2+esm1","1:20.2.2+dfsg-1ubuntu2+esm2","1:20.2.2+dfsg-1ubuntu2+esm3"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1ubuntu0.5+esm3"}]}],"versions":["1:22.0.7+dfsg-1build1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1","1:22.2.7+dfsg-1ubuntu0.2","1:22.2.7+dfsg-1ubuntu0.3","1:22.2.7+dfsg-1ubuntu0.4","1:22.2.7+dfsg-1ubuntu0.5","1:22.2.7+dfsg-1ubuntu0.5+esm1","1:22.2.7+dfsg-1ubuntu0.5+esm2"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.2.1+dfsg-1ubuntu0.8"}]}],"versions":["1:23.2.6+dfsg-1build1","1:24.1.1+dfsg-1","1:24.1.4+dfsg-1","1:24.1.5+dfsg-1","1:24.1.5+dfsg-1ubuntu1","1:24.2+dfsg-1","1:24.2.1+dfsg-1","1:24.2.1+dfsg-1ubuntu0.1","1:24.2.1+dfsg-1ubuntu0.2","1:24.2.1+dfsg-1ubuntu0.3","1:24.2.1+dfsg-1ubuntu0.4","1:24.2.1+dfsg-1ubuntu0.5","1:24.2.1+dfsg-1ubuntu0.6","1:24.2.1+dfsg-1ubuntu0.7"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.3.2.8+dfsg-1ubuntu4.8"}]}],"versions":["1:25.2.3+dfsg-1","1:25.3.2.8+dfsg-1","1:25.3.2.8+dfsg-1ubuntu1","1:25.3.2.8+dfsg-1ubuntu3","1:25.3.2.8+dfsg-1ubuntu4","1:25.3.2.8+dfsg-1ubuntu4.1","1:25.3.2.8+dfsg-1ubuntu4.2","1:25.3.2.8+dfsg-1ubuntu4.3","1:25.3.2.8+dfsg-1ubuntu4.4","1:25.3.2.8+dfsg-1ubuntu4.5","1:25.3.2.8+dfsg-1ubuntu4.6","1:25.3.2.8+dfsg-1ubuntu4.7"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.6+dfsg-1ubuntu0.2"}]}],"versions":["1:27.3.4.1+dfsg-1build1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1","1:27.3.4.6+dfsg-1ubuntu0.1"],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"erlang27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1.3-2.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1.3-160000.4.1"}]}],"bundled":7}],"products":[{"vendor":"erlang","product":"erlang\\/otp"},{"vendor":"erlang","product":"erlang\\/ssh"},{"vendor":"erlang","product":"otp"}],"references":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-4749-w85x-hw9h","tags":["vendor-advisory","related","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://cna.erlef.org/cves/CVE-2026-23942.html","tags":["related","Vendor Advisory","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-23942","tags":["related","Vendor Advisory","web"]},{"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions","tags":["x_version-scheme","Product","web","report"]},{"url":"https://github.com/erlang/otp/commit/27688a824f753d4c16371dc70e88753fb410590b","tags":["patch","Patch","fix","report"]},{"url":"https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28","tags":["patch","Patch","fix","report"]},{"url":"https://github.com/erlang/otp/commit/5ed603a1211b83b8be2d1fc06d3f3bf30c3c9759","tags":["patch","Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23942","tags":["web","advisory"]},{"url":"https://github.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23942.json","tags":["advisory"]},{"url":"https://github.com/erlang/otp","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-23942","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23941","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23943","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1666","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1667","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1668","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21620","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261714-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258663","tags":["report"]},{"url":"https://bugzilla.suse.com/1259681","tags":["report"]},{"url":"https://bugzilla.suse.com/1259682","tags":["report"]},{"url":"https://bugzilla.suse.com/1259687","tags":["report"]},{"url":"https://bugzilla.suse.com/1261728","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28808","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262010-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262503","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32147","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621374-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261726","tags":["report"]},{"url":"https://bugzilla.suse.com/1261734","tags":["report"]},{"url":"https://bugzilla.suse.com/1262288","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32144","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-23942","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23942","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8901-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-4748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-26618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-30211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-21620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-28808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-28810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42791","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-49760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-53422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-65634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-68956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89422","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42791","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-23942","title":"SFTP root escape via component-agnostic prefix check in ssh_sftpd","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.","status":"published","published":"2026-03-13T09:11:56.424Z","modified":"2026-07-24T14:16:12.645Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:42:15.603999Z"}],"euvd":[{"id":"EUVD-2026-11778","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.","status":"published","published":"2026-03-13T09:11:56Z","modified":"2026-07-24T14:16:12Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:19:40.671085Z"}],"nvd":[{"id":"CVE-2026-23942","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.","status":"published","published":"2026-03-13T19:54:15.52Z","modified":"2026-07-24T15:17:14.343Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"CVE-2026-23942","title":"SFTP root escape via component-agnostic prefix check in ssh_sftpd","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.","status":"published","published":"2026-03-13T09:11:56.424Z","modified":"2026-10-28T02:31:00.452453584Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"DEBIAN-CVE-2026-23942","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.  This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.  The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.  This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.","status":"published","published":"2026-03-13T19:54:15.52Z","modified":"2026-10-01T03:03:00.304089286Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"EEF-CVE-2026-23942","title":"SFTP root escape via component-agnostic prefix check in ssh_sftpd","description":"## Summary\n\nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh\\_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh\\_sftpd.erl and program routines ssh\\_sftpd:is\\_within\\_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1\\_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.\n\n## Workarounds\n\n\\* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment.\n\\* Ensure that no sensitive or precious data is readable or writable by the OS user running the Erlang VM.\n\\* Ensure that the SFTP server port is not reachable from untrusted machines.\n\\* Use directory naming conventions that avoid common prefixes (e.g., /home/users/alice/ instead of /home/user1/).\n\n## Configurations\n\nThe SFTP subsystem must be enabled on the SSH server, the SSH port must be reachable by the attacker, and a root directory must be configured. This is the case when ssh\\_sftpd is included in the subsystems option with a root parameter and there exist sibling directories sharing the same name prefix as the root.","status":"published","published":"2026-03-13T09:11:56.424Z","modified":"2026-09-08T03:30:09.354019271Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:33.047032Z"},{"id":"OESA-2026-1665","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:41.503288393Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1666","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:40.473583288Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1667","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:40.48726561Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1668","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:41.531621087Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-2704","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime\nenvironment. Erlang has built-in support for concurrency, distribution\nand fault tolerance. Erlang is used in several large telecommunication\nsystems from Ericsson.\r\n\r\n\nSecurity Fix(es):\n\nRelative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.\n\nThis issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.(CVE-2026-21620)\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-06-24T11:11:38Z","modified":"2026-08-18T01:20:05.995131714Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-23942","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.","status":"published","published":"2026-03-13T19:54:00Z","modified":"2026-10-08T19:47:07.047323928Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-79874","title":"CVE-2026-23942 affecting package erlang for versions less than 26.2.5.18-1","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 before 5.5.1, 5.2.11.6 and 5.1.4.14.","status":"published","published":"2026-03-13T19:54:15Z","modified":"2026-08-28T17:56:47.121651Z","updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"openSUSE-SU-2026:10947-1","title":"erlang27-27.1.3-2.1 on GA media","description":"These are all security issues fixed in the erlang27-27.1.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-03T00:00:00Z","modified":"2026-06-04T09:00:08.489232736Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20607-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and remote\n  arbitrary reads/writes (bsc#1258663).\n- CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP request\n  smuggling (bsc#1259687).\n- CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead to path\n  traversal (bsc#1259681).\n- CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of service\n  (bsc#1259682).\n- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).\n- CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).\n- CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information disclosure\n  (bsc#1261734).\n\nOther updates and bugfixes:\n\n- jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).\n","status":"published","published":"2026-04-22T10:52:20Z","modified":"2026-04-24T08:16:29.068648Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1714-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\n- CVE-2026-21620: remote arbitrary read/write via TFTP relative path traversal (bsc#1258663).\n- CVE-2026-23941: HTTP Request Smuggling in Erlang OTP (bsc#1259687).\n- CVE-2026-23942: path traversal vulnerability in Erlang OTP (bsc#1259681).\n- CVE-2026-23943: denial of service due to improper handling of highly compressed data in Erlang OTP ssh (bsc#1259682).\n- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).\n","status":"published","published":"2026-05-06T12:08:10Z","modified":"2026-05-07T08:46:27.139005Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2010-1","title":"Security update for erlang26","description":"This update for erlang26 fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-21620: remote arbitrary read/write via TFTP relative path traversal (bsc#1258663).\n- CVE-2026-23941: HTTP Request Smuggling in Erlang OTP (bsc#1259687).\n- CVE-2026-23942: path traversal vulnerability in Erlang OTP (bsc#1259681).\n- CVE-2026-23943: denial of service due to improper handling of highly compressed data in Erlang OTP ssh (bsc#1259682).\n- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).\n- CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot\n  (bsc#1262503).\n\nNon security issue:\n\n- Fixes for FIPS mode (jsc#PED-15166.\n","status":"published","published":"2026-05-19T11:56:05Z","modified":"2026-05-20T08:00:18.312055064Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21374-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and remote\n  arbitrary reads/writes (bsc#1258663).\n- CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP request\n  smuggling (bsc#1259687).\n- CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead to path\n  traversal (bsc#1259681).\n- CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of service\n  (bsc#1259682).\n- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).\n- CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).\n- CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information disclosure\n  (bsc#1261734).\n\nOther updates and bugfixes:\n\n- jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).\n","status":"published","published":"2026-04-22T11:46:09Z","modified":"2026-04-29T18:23:58.002335Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-8901-1","title":"erlang vulnerabilities","description":"Wander Nauta discovered that Erlang incorrectly handled absolute paths when\nextracting zip archives. An attacker could possibly use this issue to write\narbitrary files outside of the intended directory. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-4748)\n\nIt was discovered that the Erlang SFTP server did not properly limit the\nsize of packets. A remote attacker could possibly use this issue to cause\nErlang to use excessive resources, leading to a denial of service. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and\nUbuntu 18.04 LTS. (CVE-2025-26618)\n\nIt was discovered that the Erlang SSH server did not properly limit the\nlength of algorithm names in key exchange messages. A remote attacker could\npossibly use this issue to cause Erlang to use excessive resources, leading\nto a denial of service. This issue only affected Ubuntu 14.04 LTS,\nUbuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-30211)\n\nIt was discovered that the Erlang TFTP server incorrectly handled certain\nfile paths. A remote attacker could possibly use this issue to access files\noutside of the intended directory. (CVE-2026-21620)\n\nIt was discovered that the Erlang SFTP server incorrectly validated paths\nagainst the configured root directory. An authenticated user could possibly\nuse this issue to access files outside of the root directory.\n(CVE-2026-23942)\n\nIt was discovered that the Erlang SSH server enabled zlib compression by\ndefault and did not limit the size of decompressed data. A remote attacker\ncould possibly use this issue to cause Erlang to use excessive resources,\nleading to a denial of service. (CVE-2026-23943)\n\nIt was discovered that the Erlang HTTP server incorrectly applied directory\naccess controls to CGI scripts served via script aliases. A remote attacker\ncould possibly use this issue to bypass authentication and access protected\nCGI scripts. (CVE-2026-28808)\n\nIt was discovered that the Erlang DNS resolver used predictable transaction\nIDs and did not randomize source ports. A remote attacker could possibly\nuse this issue to perform DNS cache poisoning attacks. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-28810)\n\nIt was discovered that Erlang did not verify the signatures of designated\nOCSP responder certificates. A remote attacker could possibly use this\nissue to forge OCSP responses and bypass certificate revocation checks.\nThis issue only affected Ubuntu 26.04 LTS. (CVE-2026-32144)\n\nIt was discovered that the Erlang SFTP server incorrectly handled file\nattribute changes on open file handles. An authenticated user could\npossibly use this issue to modify the attributes of files outside of the\nroot directory. (CVE-2026-32147)\n\nIt was discovered that Erlang incorrectly allowed non-CA certificates to\nact as intermediate certificate issuers. A remote attacker could possibly\nuse this issue to forge certificate chains. (CVE-2026-42789)\n\nIt was discovered that Erlang incorrectly handled DNS name constraints\nduring hostname verification. A remote attacker could possibly use this\nissue to bypass certificate validation. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and\nUbuntu 26.04 LTS. (CVE-2026-42790)\n\nIt was discovered that Erlang did not check the validity period of OCSP\nresponder certificates. A remote attacker could possibly use this issue to\nforge OCSP responses using an expired responder certificate. This issue\nonly affected Ubuntu 26.04 LTS. (CVE-2026-42791)\n\nIt was discovered that Erlang incorrectly handled relative paths when\nextracting zip archives. An attacker could possibly use this issue to write\narbitrary files outside of the intended directory. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and\nUbuntu 26.04 LTS. (CVE-2026-47078)\n\nIt was discovered that the Erlang SFTP server exposed absolute paths when\nreading symbolic links. An authenticated user could possibly use this issue\nto obtain sensitive information. (CVE-2026-48855)\n\nIt was discovered that the Erlang HTTP client forwarded authorization\nheaders on cross-origin redirects. A malicious HTTP server could possibly\nuse this issue to obtain sensitive information. (CVE-2026-48856)\n\nIt was discovered that the Erlang FTP client did not validate the IP\naddress in passive mode responses. A malicious FTP server could possibly\nuse this issue to perform server-side request forgery attacks.\n(CVE-2026-48858)\n\nIt was discovered that Erlang checked the local address instead of the peer\naddress when enforcing the allowlist for distribution over TLS. A remote\nattacker could possibly use this issue to bypass access restrictions. This\nissue only affected Ubuntu 26.04 LTS. (CVE-2026-48860)\n\nIt was discovered that Erlang incorrectly handled certain SCTP ERROR\nchunks, leading to a buffer overflow. A remote attacker could possibly use\nthis issue to cause Erlang to crash, resulting in a denial of service.\n(CVE-2026-49759)\n\nIt was discovered that the Erlang erl_interface library incorrectly handled\nprinting very large integers, leading to a buffer overflow. An attacker\ncould possibly use this issue to cause Erlang to crash or execute arbitrary\ncode. (CVE-2026-49760)\n\nIt was discovered that the Erlang SFTP server incorrectly handled certain\npath resolution requests. An authenticated user could possibly use this\nissue to determine the existence of files outside of the root directory.\n(CVE-2026-53422)\n\nIt was discovered that the Erlang SFTP server incorrectly handled extended\nchannel data, leading to an infinite loop. An authenticated user could\npossibly use this issue to cause a denial of service. (CVE-2026-54886)\n\nIt was discovered that the Erlang DTLS server used a predictable cookie\nsecret on startup. A remote attacker could possibly use this issue to\nbypass source address verification. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and\nUbuntu 26.04 LTS. (CVE-2026-54887)\n\nIt was discovered that Erlang TLS clients incorrectly accepted application\ndata before the handshake was completed. A remote attacker could possibly\nuse this issue to inject arbitrary data into TLS connections.\n(CVE-2026-54891)\n\nIt was discovered that the Erlang DTLS server contained a race condition\nwhen handling rapid client reconnections. A remote attacker could possibly\nuse this issue to cause Erlang to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n(CVE-2026-55950)\n\nIt was discovered that Erlang did not properly validate TLS 1.3 pre-shared\nkey extensions. A remote attacker could possibly use this issue to cause\nErlang to crash, resulting in a denial of service. This issue only affected\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-55952)\n\nIt was discovered that the Erlang ASN.1 decoder incorrectly handled certain\nobject identifiers. A remote attacker could possibly use this issue to\ncause Erlang to use excessive resources, leading to a denial of service.\n(CVE-2026-65634)\n\nIt was discovered that the Erlang SSH server did not properly limit the\nnumber of open channels. An authenticated user could possibly use this\nissue to cause Erlang to use excessive resources, leading to a denial of\nservice. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-68956)\n\nIt was discovered that the Erlang HTTP server incorrectly shared users and\ngroups between directories when using dets or mnesia authentication\nbackends. A remote attacker could possibly use this issue to bypass\nauthentication and access protected directories. (CVE-2026-74994)\n\nIt was discovered that Erlang TLS clients incorrectly accepted unsolicited\nTLS 1.3 pre-shared keys from servers. A remote attacker could possibly use\nthis issue to impersonate servers. This issue only affected\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-89422)","status":"published","published":"2026-10-08T12:01:56Z","modified":"2026-10-08T19:58:53.589918012Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}