{"id":"CVE-2026-54890","aliases":["DEBIAN-CVE-2026-54890","EEF-CVE-2026-54890","EUVD-2026-49326","GHSA-54pw-5645-jh86","RHSA-2026:47009","UBUNTU-CVE-2026-54890","USN-8827-1","openSUSE-SU-2026:11559-1","openSUSE-SU-2026:11560-1"],"status":"published","title":"BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding","description":"Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\".\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0042,"percentile":0.36625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284","CWE-191","CWE-789"],"published":"2026-07-27T15:39:03Z","modified":"2026-10-28T11:14:43Z","fixes":[{"ecosystem":"Debian:13","package":"erlang","fixed_in":["1:27.3.4.1+dfsg-1+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"erlang","fixed_in":["1:29.0.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"erlang","fixed_in":["1:27.3.4.6+dfsg-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:25.2.3+dfsg-1","1:25.2.3+dfsg-1+deb12u1","1:25.2.3+dfsg-1+deb12u2","1:25.2.3+dfsg-1+deb12u3","1:25.2.3+dfsg-1+deb12u4","1:25.3.2.10+dfsg-1","1:25.3.2.10+dfsg-2","1:25.3.2.11+dfsg-1","1:25.3.2.12+dfsg-1","1:25.3.2.12+dfsg-2","1:25.3.2.12+dfsg-3","1:25.3.2.8+dfsg-1","1:26.0+dfsg-1","1:26.0.1+dfsg-1","1:26.0.2+dfsg-1","1:26.0~rc2+dfsg-1","1:26.0~rc3+dfsg-1","1:26.1.2+dfsg-1","1:26.2.1+dfsg-1","1:26.2.4+dfsg-1","1:27.0+dfsg-1","1:27.0.1+dfsg-1","1:27.0.1+dfsg-2","1:27.0.1+dfsg-3","1:27.0~rc3+dfsg-1","1:27.0~rc3+dfsg-2","1:27.0~rc3+dfsg-3","1:27.0~rc3+dfsg-4","1:27.1.2+dfsg-1","1:27.2+dfsg-1","1:27.2+dfsg-2","1:27.2+dfsg-3~exp1","1:27.2.1+dfsg-1","1:27.2.1+dfsg-2","1:27.2.2+dfsg-1","1:27.2.3+dfsg-1","1:27.2.4+dfsg-1","1:27.3+dfsg-1","1:27.3.1+dfsg-1","1:27.3.2+dfsg-1","1:27.3.3+dfsg-1","1:27.3.4+dfsg-1","1:27.3.4.1+dfsg-1","1:27.3.4.10+dfsg-1","1:27.3.4.11+dfsg-1","1:27.3.4.11+dfsg-2","1:27.3.4.11+dfsg-3","1:27.3.4.11+dfsg-4","1:27.3.4.11+dfsg-5","1:27.3.4.11+dfsg-6","1:27.3.4.11+dfsg-7","1:27.3.4.12+dfsg-1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1","1:27.3.4.8+dfsg-1","1:27.3.4.9+dfsg-1","1:28.0+dfsg-1","1:28.0.1+dfsg-1","1:28.0.2+dfsg-1","1:28.0.4+dfsg-1","1:28.1.1+dfsg-1","1:28.2+dfsg-1","1:28.3+dfsg-1","1:28.3.1+dfsg-1","1:29.0+dfsg-1","1:29.0+dfsg-2","1:29.0.1+dfsg-1","1:29.0.2+dfsg-1","1:29.0.3+dfsg-1","1:29.0.4+dfsg-1","1:29.0.6+dfsg-1","1:29.0~rc1+dfsg-1","1:29.0~rc1+dfsg-2","1:29.0~rc2+dfsg-1","1:29.0~rc3+dfsg-1","1:29.0~rc3+dfsg-2","1:29.0~rc3+dfsg-3","1:29.0~rc3+dfsg-4","1:29.1.1+dfsg-1","1:29.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.1+dfsg-1+deb13u3"}]}],"versions":["1:27.3.4.1+dfsg-1","1:27.3.4.1+dfsg-1+deb13u1","1:27.3.4.1+dfsg-1+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.0.4+dfsg-1"}]}],"versions":["1:27.3.4.1+dfsg-1","1:27.3.4.10+dfsg-1","1:27.3.4.11+dfsg-1","1:27.3.4.11+dfsg-2","1:27.3.4.11+dfsg-3","1:27.3.4.11+dfsg-4","1:27.3.4.11+dfsg-5","1:27.3.4.11+dfsg-6","1:27.3.4.11+dfsg-7","1:27.3.4.12+dfsg-1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1","1:27.3.4.8+dfsg-1","1:27.3.4.9+dfsg-1","1:28.0+dfsg-1","1:28.0.1+dfsg-1","1:28.0.2+dfsg-1","1:28.0.4+dfsg-1","1:28.1.1+dfsg-1","1:28.2+dfsg-1","1:28.3+dfsg-1","1:28.3.1+dfsg-1","1:29.0+dfsg-1","1:29.0+dfsg-2","1:29.0.1+dfsg-1","1:29.0.2+dfsg-1","1:29.0.3+dfsg-1","1:29.0~rc1+dfsg-1","1:29.0~rc1+dfsg-2","1:29.0~rc2+dfsg-1","1:29.0~rc3+dfsg-1","1:29.0~rc3+dfsg-2","1:29.0~rc3+dfsg-3","1:29.0~rc3+dfsg-4"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-asn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-common_test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-debugger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-dialyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-diameter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-edoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-eldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-erl_interface","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-erts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-et","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-eunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-ftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-gdb-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-inets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-jinterface","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-megaco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-mnesia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-observer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-os_mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-parsetools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-public_key","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-reltool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-runtime_tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-syntax_tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-wx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"erlang27-xmerl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.3.4.15-0.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.6+dfsg-1ubuntu0.1"}]}],"versions":["1:27.3.4.1+dfsg-1build1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2+esm2"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1","1:16.b.3-dfsg-1ubuntu2.2","1:16.b.3-dfsg-1ubuntu2.2+esm1"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.3-dfsg-1ubuntu3.1+esm3"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3","1:18.3-dfsg-1ubuntu3.1","1:18.3-dfsg-1ubuntu3.1+esm1","1:18.3-dfsg-1ubuntu3.1+esm2"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.2.2+dfsg-1ubuntu2+esm3"}]}],"versions":["1:20.0.4+dfsg-1ubuntu1","1:20.1.2+dfsg-1ubuntu1","1:20.1.3+dfsg-1ubuntu1","1:20.1.4+dfsg-1ubuntu1","1:20.1.5+dfsg-1ubuntu1","1:20.1.6+dfsg-1ubuntu1","1:20.1.7+dfsg-1ubuntu1","1:20.2.1+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu2","1:20.2.2+dfsg-1ubuntu2+esm1","1:20.2.2+dfsg-1ubuntu2+esm2"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1ubuntu0.5+esm2"}]}],"versions":["1:22.0.7+dfsg-1build1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1","1:22.2.7+dfsg-1ubuntu0.2","1:22.2.7+dfsg-1ubuntu0.3","1:22.2.7+dfsg-1ubuntu0.4","1:22.2.7+dfsg-1ubuntu0.5","1:22.2.7+dfsg-1ubuntu0.5+esm1"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.2.1+dfsg-1ubuntu0.7"}]}],"versions":["1:23.2.6+dfsg-1build1","1:24.1.1+dfsg-1","1:24.1.4+dfsg-1","1:24.1.5+dfsg-1","1:24.1.5+dfsg-1ubuntu1","1:24.2+dfsg-1","1:24.2.1+dfsg-1","1:24.2.1+dfsg-1ubuntu0.1","1:24.2.1+dfsg-1ubuntu0.2","1:24.2.1+dfsg-1ubuntu0.3","1:24.2.1+dfsg-1ubuntu0.4","1:24.2.1+dfsg-1ubuntu0.5","1:24.2.1+dfsg-1ubuntu0.6"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.3.2.8+dfsg-1ubuntu4.7"}]}],"versions":["1:25.2.3+dfsg-1","1:25.3.2.8+dfsg-1","1:25.3.2.8+dfsg-1ubuntu1","1:25.3.2.8+dfsg-1ubuntu3","1:25.3.2.8+dfsg-1ubuntu4","1:25.3.2.8+dfsg-1ubuntu4.1","1:25.3.2.8+dfsg-1ubuntu4.2","1:25.3.2.8+dfsg-1ubuntu4.3","1:25.3.2.8+dfsg-1ubuntu4.4","1:25.3.2.8+dfsg-1ubuntu4.5","1:25.3.2.8+dfsg-1ubuntu4.6"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.6+dfsg-1ubuntu0.1"}]}],"versions":["1:27.3.4.1+dfsg-1build1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1"],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.5.0.4-1.1"}]}],"bundled":24},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"erlang27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1.3-3.1"}]}],"bundled":21}],"products":[{"vendor":"erlang","product":"erlang\\/otp"},{"vendor":"erlang","product":"erts"},{"vendor":"erlang","product":"otp"}],"references":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86","tags":["vendor-advisory","related","Vendor Advisory","advisory","article"]},{"url":"https://cna.erlef.org/cves/CVE-2026-54890.html","tags":["related","Patch","Third Party Advisory","web","article"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-54890","tags":["related","Patch","Third Party Advisory","web","article"]},{"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions","tags":["x_version-scheme","Release Notes","web","article"]},{"url":"https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd","tags":["patch","Patch","fix","article"]},{"url":"https://github.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54890.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54890","tags":["advisory"]},{"url":"https://github.com/erlang/otp","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54890","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47009","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59251","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42792","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55953","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59250","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54890","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47009.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507551","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42792","tags":["advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-42792.html","tags":["article"]},{"url":"https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb","tags":["article"]},{"url":"https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6","tags":["article"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-42792","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507571","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54890","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55953","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55953","tags":["advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-55953.html","tags":["article"]},{"url":"https://github.com/erlang/otp/commit/064e236414614f9085cbbbd6eacf0e43c02d1b4b","tags":["article"]},{"url":"https://github.com/erlang/otp/commit/0a82596d425abe43dc2e0b3d74aa1557ef74051c","tags":["article"]},{"url":"https://github.com/erlang/otp/commit/e6ff938116b2872bccc478af7fefb56627285b77","tags":["article"]},{"url":"https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882","tags":["article"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-55953","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59250","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59250","tags":["advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-59250.html","tags":["article"]},{"url":"https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f","tags":["article"]},{"url":"https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7","tags":["article"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-59250","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507572","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59251","tags":["advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-59251.html","tags":["article"]},{"url":"https://github.com/erlang/otp/commit/f04c6bba38de1cf1b1836a7d9a9fbe239bd939e8","tags":["article"]},{"url":"https://github.com/erlang/otp/commit/f8580fc117098c08165f46c26fd0750c5cfb2a90","tags":["article"]},{"url":"https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352","tags":["article"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-59251","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-54890","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8827-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-23941","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-66357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-66835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-69664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-70399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-71380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75538","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26618","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-54890","title":"BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding","description":"Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\".\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.","status":"published","published":"2026-07-27T15:39:03.475Z","modified":"2026-07-28T09:55:08.138Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-191","CWE-789","CWE-1284"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-49326","description":"Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\".\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.","status":"published","published":"2026-07-27T15:39:03Z","modified":"2026-07-28T09:55:08Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:31.827348Z"}],"nvd":[{"id":"CVE-2026-54890","description":"Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\".\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.","status":"published","published":"2026-07-27T16:17:41.437Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-191","CWE-789","CWE-1284"],"updated_at":"2026-11-02T14:12:33.249634Z"}],"osv":[{"id":"CVE-2026-54890","title":"BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding","description":"Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\".\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.","status":"published","published":"2026-07-27T15:39:03.475Z","modified":"2026-10-28T11:14:43.494626172Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1284","CWE-191","CWE-789"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54890","description":"Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.  The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\".  The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).  Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).  This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.","status":"published","published":"2026-07-27T16:17:41.437Z","modified":"2026-10-25T10:01:02.169998936Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"EEF-CVE-2026-54890","title":"BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding","description":"## Summary\n\nInteger Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT\\_BINARY\\_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\".\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the \\[safe\\] option to binary\\_to\\_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary\\_to\\_term/1,2 or enif\\_binary\\_to\\_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.\n\n## Workarounds\n\nDo not call binary\\_to\\_term/1,2 or enif\\_binary\\_to\\_term() on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.","status":"published","published":"2026-07-27T15:39:03.475Z","modified":"2026-09-08T08:04:01.757694Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-191","CWE-789","CWE-1284"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"RHSA-2026:47009","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-30T10:17:29Z","modified":"2026-10-06T10:31:35.525296254Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-54890","description":"Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as \"Cannot allocate 2305843009213693951 bytes of memory (of type binary)\". The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings). Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.","status":"published","published":"2026-07-27T16:17:00Z","modified":"2026-09-28T22:45:11.713702512Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"openSUSE-SU-2026:11559-1","title":"erlang-28.5.0.4-1.1 on GA media","description":"These are all security issues fixed in the erlang-28.5.0.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-20T00:00:00Z","modified":"2026-08-21T09:15:09.246696292Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11560-1","title":"erlang27-27.1.3-3.1 on GA media","description":"These are all security issues fixed in the erlang27-27.1.3-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-20T00:00:00Z","modified":"2026-08-21T09:15:09.294918569Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"USN-8827-1","title":"erlang vulnerabilities","description":"It was discovered that the Erlang Port Mapper Daemon did not properly\nhandle slow connections. A remote attacker could possibly use this issue\nto cause a denial of service. (CVE-2026-42792)\n\nIt was discovered that Erlang incorrectly handled certain external term\nformat data, leading to heap corruption. An attacker could possibly use\nthis issue to cause Erlang to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n(CVE-2026-55737)\n\nIt was discovered that Erlang incorrectly handled invalid external term\nformat data. An attacker could possibly use this issue to cause Erlang to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n26.04 LTS. (CVE-2026-54890)\n\nIt was discovered that Erlang incorrectly handled certain packet lengths,\nleading to a buffer overflow. A remote attacker could possibly use this\nissue to cause Erlang to crash or execute arbitrary code. (CVE-2026-75538)\n\nIt was discovered that the Erlang Megaco flex scanner incorrectly handled\ncertain input, leading to a buffer overflow. A remote attacker could\npossibly use this issue to cause Erlang to crash or execute arbitrary code.\n(CVE-2026-59250)\n\nIt was discovered that Erlang TLS clients incorrectly accepted cipher\nsuites that they had not offered. A remote attacker could possibly use\nthis issue to intercept and modify TLS communications. (CVE-2026-55953)\n\nIt was discovered that Erlang incorrectly handled certain certificate\nchains. A remote attacker could possibly use this issue to cause Erlang to\nuse excessive resources, leading to a denial of service. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-58227)\n\nIt was discovered that Erlang incorrectly handled certain certificate\npolicies. A remote attacker could possibly use this issue to cause Erlang\nto use excessive resources, leading to a denial of service. This issue only\naffected Ubuntu 26.04 LTS. (CVE-2026-59251)\n\nIt was discovered that the Erlang HTTP server incorrectly handled certain\nconflicting HTTP framing headers. A remote attacker could possibly use this\nissue to smuggle HTTP requests. (CVE-2026-23941, CVE-2026-73812)\n\nIt was discovered that the Erlang HTTP server incorrectly handled certain\nmalformed chunk sizes. A remote attacker could possibly use this issue to\ncause Erlang to crash, resulting in a denial of service. (CVE-2026-69664)\n\nIt was discovered that the Erlang HTTP server did not properly limit the\nsize of chunked request bodies. A remote attacker could possibly use this\nissue to cause Erlang to use excessive resources, leading to a denial of\nservice. (CVE-2026-74835)\n\nIt was discovered that the Erlang HTTP server incorrectly handled certain\nequivalent request paths and differences in character case. A remote\nattacker could possibly use this issue to bypass authentication and gain\nunauthorized access. (CVE-2026-66835, CVE-2026-73270)\n\nIt was discovered that the Erlang HTTP server did not properly limit\nsimultaneous connections. A remote attacker could possibly use this issue\nto cause Erlang to use excessive resources, leading to a denial of service.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-70399)\n\nIt was discovered that the Erlang HTTP server incorrectly handled header\ncontinuation lines. A remote attacker could possibly use this issue to\nsmuggle HTTP requests. (CVE-2026-66357)\n\nIt was discovered that the Erlang HTTP server incorrectly handled certain\nmalformed header names. A remote attacker could possibly use this issue to\nsmuggle HTTP requests. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-73276)\n\nIt was discovered that the Erlang HTTP server incorrectly handled\nincomplete request bodies. A remote attacker could possibly use this issue\nto cause Erlang to use excessive resources, leading to a denial of service.\n(CVE-2026-71380)\n\nIt was discovered that the Erlang HTTP client did not properly limit the\nsize of HTTP response headers. A malicious HTTP server could possibly use\nthis issue to cause Erlang to use excessive resources, leading to a denial\nof service. (CVE-2026-55951)\n\nIt was discovered that Erlang did not properly limit the length of port\nnumbers when parsing URIs. A remote attacker could possibly use this issue\nto cause Erlang to use excessive resources, leading to a denial of service.\nThis issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-59696)\n\nIt was discovered that the Erlang SNMP application did not properly limit\nthe size of certain integer values. A remote attacker could possibly use\nthis issue to cause Erlang to use excessive resources, leading to a denial\nof service. (CVE-2026-70405)\n\nIt was discovered that the Erlang LDAP client did not properly limit the\nlength of port numbers in referral URLs. A malicious LDAP server could\npossibly use this issue to cause Erlang to use excessive resources, leading\nto a denial of service. (CVE-2026-70409)","status":"published","published":"2026-09-28T13:21:58Z","modified":"2026-09-28T22:57:44.139860303Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}