Summary
It was discovered that the Erlang Port Mapper Daemon did not properly
handle slow connections. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2026-42792)
It was discovered that Erlang incorrectly handled certain external term
format data, leading to heap corruption. An attacker could possibly use
this issue to cause Erlang to crash, resulting in a denial of service.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-55737)
It was discovered that Erlang incorrectly handled invalid external term
format data. An attacker could possibly use this issue to cause Erlang to
crash, resulting in a denial of service. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-54890)
It was discovered that Erlang incorrectly handled certain packet lengths,
leading to a buffer overflow. A remote attacker could possibly use this
issue to cause Erlang to crash or execute arbitrary code. (CVE-2026-75538)
It was discovered that the Erlang Megaco flex scanner incorrectly handled
certain input, leading to a buffer overflow. A remote attacker could
possibly use this issue to cause Erlang to crash or execute arbitrary code.
(CVE-2026-59250)
It was discovered that Erlang TLS clients incorrectly accepted cipher
suites that they had not offered. A remote attacker could possibly use
this issue to intercept and modify TLS communications. (CVE-2026-55953)
It was discovered that Erlang incorrectly handled certain certificate
chains. A remote attacker could possibly use this issue to cause Erlang to
use excessive resources, leading to a denial of service. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-58227)
It was discovered that Erlang incorrectly handled certain certificate
policies. A remote attacker could possibly use this issue to cause Erlang
to use excessive resources, leading to a denial of service. This issue only
affected Ubuntu 26.04 LTS. (CVE-2026-59251)
It was discovered that the Erlang HTTP server incorrectly handled certain
conflicting HTTP framing headers. A remote attacker could possibly use this
issue to smuggle HTTP requests. (CVE-2026-23941, CVE-2026-73812)
It was discovered that the Erlang HTTP server incorrectly handled certain
malformed chunk sizes. A remote attacker could possibly use this issue to
cause Erlang to crash, resulting in a denial of service. (CVE-2026-69664)
It was discovered that the Erlang HTTP server did not properly limit the
size of chunked request bodies. A remote attacker could possibly use this
issue to cause Erlang to use excessive resources, leading to a denial of
service. (CVE-2026-74835)
It was discovered that the Erlang HTTP server incorrectly handled certain
equivalent request paths and differences in character case. A remote
attacker could possibly use this issue to bypass authentication and gain
unauthorized access. (CVE-2026-66835, CVE-2026-73270)
It was discovered that the Erlang HTTP server did not properly limit
simultaneous connections. A remote attacker could possibly use this issue
to cause Erlang to use excessive resources, leading to a denial of service.
This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-70399)
It was discovered that the Erlang HTTP server incorrectly handled header
continuation lines. A remote attacker could possibly use this issue to
smuggle HTTP requests. (CVE-2026-66357)
It was discovered that the Erlang HTTP server incorrectly handled certain
malformed header names. A remote attacker could possibly use this issue to
smuggle HTTP requests. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-73276)
It was discovered that the Erlang HTTP server incorrectly handled
incomplete request bodies. A remote attacker could possibly use this issue
to cause Erlang to use excessive resources, leading to a denial of service.
(CVE-2026-71380)
It was discovered that the Erlang HTTP client did not properly limit the
size of HTTP response headers. A malicious HTTP server could possibly use
this issue to cause Erlang to use excessive resources, leading to a denial
of service. (CVE-2026-55951)
It was discovered that Erlang did not properly limit the length of port
numbers when parsing URIs. A remote attacker could possibly use this issue
to cause Erlang to use excessive resources, leading to a denial of service.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-59696)
It was discovered that the Erlang SNMP application did not properly limit
the size of certain integer values. A remote attacker could possibly use
this issue to cause Erlang to use excessive resources, leading to a denial
of service. (CVE-2026-70405)
It was discovered that the Erlang LDAP client did not properly limit the
length of port numbers in referral URLs. A malicious LDAP server could
possibly use this issue to cause Erlang to use excessive resources, leading
to a denial of service. (CVE-2026-70409)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | erlang | 1:16.b.3-dfsg-1ubuntu2.2+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | erlang | 1:18.3-dfsg-1ubuntu3.1+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | erlang | 1:20.2.2+dfsg-1ubuntu2+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | erlang | 1:22.2.7+dfsg-1ubuntu0.5+esm2 |
Vulnerabilities 19
-
Critical 9.1
TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotia…
-
High 8.7
TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chai…
-
High 8.7
Denial of service via exponential certificate policy tree growth in path validation
Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy proce…
-
High 8.7
httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The w…
-
High 8.7
httpd does not enforce the documented default max_clients connection limit
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented t…
-
High 8.7
httpd applies no timeout while receiving a request body, parking a worker on a stalled client
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is…
-
High 8.7
inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.…
-
High 8.3
Megaco flex scanner buffer overflow via oversized property parm name
Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/…
-
High 8.3
inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request …
-
High 8.3
inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6…
-
High 8.3
inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length.…
-
High 8.2
BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.…
-
High 8.2
httpc memory exhaustion via unbounded response header accumulation
The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length c…
-
High 8.2
httpd mod_auth directory protection bypassed by a doubled slash in the request path
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normalises the request URI wi…
-
High 8.2
httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insens…
-
High 8.2
A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer
An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This…
-
High 7.0
Request smuggling via first-wins Content-Length parsing in inets httpd
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program…
-
Medium 6.3
epmd permanent DoS via EMFILE on accept(2) in erts
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src…
-
Medium 5.1
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machin…
References
-
report
https://ubuntu.com/security/CVE-2026-23941
-
report
https://ubuntu.com/security/CVE-2026-42792
-
report
https://ubuntu.com/security/CVE-2026-54890
-
report
https://ubuntu.com/security/CVE-2026-55737
-
report
https://ubuntu.com/security/CVE-2026-55951
-
report
https://ubuntu.com/security/CVE-2026-55953
-
report
https://ubuntu.com/security/CVE-2026-58227
-
report
https://ubuntu.com/security/CVE-2026-59250
-
report
https://ubuntu.com/security/CVE-2026-59251
-
report
https://ubuntu.com/security/CVE-2026-66357
-
report
https://ubuntu.com/security/CVE-2026-66835
-
report
https://ubuntu.com/security/CVE-2026-69664
-
report
https://ubuntu.com/security/CVE-2026-70399
-
report
https://ubuntu.com/security/CVE-2026-71380
-
report
https://ubuntu.com/security/CVE-2026-73270
-
report
https://ubuntu.com/security/CVE-2026-73276
-
report
https://ubuntu.com/security/CVE-2026-73812
-
report
https://ubuntu.com/security/CVE-2026-74835
-
report
https://ubuntu.com/security/CVE-2026-75538