Summary
Wander Nauta discovered that Erlang incorrectly handled absolute paths when
extracting zip archives. An attacker could possibly use this issue to write
arbitrary files outside of the intended directory. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-4748)
It was discovered that the Erlang SFTP server did not properly limit the
size of packets. A remote attacker could possibly use this issue to cause
Erlang to use excessive resources, leading to a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS. (CVE-2025-26618)
It was discovered that the Erlang SSH server did not properly limit the
length of algorithm names in key exchange messages. A remote attacker could
possibly use this issue to cause Erlang to use excessive resources, leading
to a denial of service. This issue only affected Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-30211)
It was discovered that the Erlang TFTP server incorrectly handled certain
file paths. A remote attacker could possibly use this issue to access files
outside of the intended directory. (CVE-2026-21620)
It was discovered that the Erlang SFTP server incorrectly validated paths
against the configured root directory. An authenticated user could possibly
use this issue to access files outside of the root directory.
(CVE-2026-23942)
It was discovered that the Erlang SSH server enabled zlib compression by
default and did not limit the size of decompressed data. A remote attacker
could possibly use this issue to cause Erlang to use excessive resources,
leading to a denial of service. (CVE-2026-23943)
It was discovered that the Erlang HTTP server incorrectly applied directory
access controls to CGI scripts served via script aliases. A remote attacker
could possibly use this issue to bypass authentication and access protected
CGI scripts. (CVE-2026-28808)
It was discovered that the Erlang DNS resolver used predictable transaction
IDs and did not randomize source ports. A remote attacker could possibly
use this issue to perform DNS cache poisoning attacks. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-28810)
It was discovered that Erlang did not verify the signatures of designated
OCSP responder certificates. A remote attacker could possibly use this
issue to forge OCSP responses and bypass certificate revocation checks.
This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32144)
It was discovered that the Erlang SFTP server incorrectly handled file
attribute changes on open file handles. An authenticated user could
possibly use this issue to modify the attributes of files outside of the
root directory. (CVE-2026-32147)
It was discovered that Erlang incorrectly allowed non-CA certificates to
act as intermediate certificate issuers. A remote attacker could possibly
use this issue to forge certificate chains. (CVE-2026-42789)
It was discovered that Erlang incorrectly handled DNS name constraints
during hostname verification. A remote attacker could possibly use this
issue to bypass certificate validation. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and
Ubuntu 26.04 LTS. (CVE-2026-42790)
It was discovered that Erlang did not check the validity period of OCSP
responder certificates. A remote attacker could possibly use this issue to
forge OCSP responses using an expired responder certificate. This issue
only affected Ubuntu 26.04 LTS. (CVE-2026-42791)
It was discovered that Erlang incorrectly handled relative paths when
extracting zip archives. An attacker could possibly use this issue to write
arbitrary files outside of the intended directory. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and
Ubuntu 26.04 LTS. (CVE-2026-47078)
It was discovered that the Erlang SFTP server exposed absolute paths when
reading symbolic links. An authenticated user could possibly use this issue
to obtain sensitive information. (CVE-2026-48855)
It was discovered that the Erlang HTTP client forwarded authorization
headers on cross-origin redirects. A malicious HTTP server could possibly
use this issue to obtain sensitive information. (CVE-2026-48856)
It was discovered that the Erlang FTP client did not validate the IP
address in passive mode responses. A malicious FTP server could possibly
use this issue to perform server-side request forgery attacks.
(CVE-2026-48858)
It was discovered that Erlang checked the local address instead of the peer
address when enforcing the allowlist for distribution over TLS. A remote
attacker could possibly use this issue to bypass access restrictions. This
issue only affected Ubuntu 26.04 LTS. (CVE-2026-48860)
It was discovered that Erlang incorrectly handled certain SCTP ERROR
chunks, leading to a buffer overflow. A remote attacker could possibly use
this issue to cause Erlang to crash, resulting in a denial of service.
(CVE-2026-49759)
It was discovered that the Erlang erl_interface library incorrectly handled
printing very large integers, leading to a buffer overflow. An attacker
could possibly use this issue to cause Erlang to crash or execute arbitrary
code. (CVE-2026-49760)
It was discovered that the Erlang SFTP server incorrectly handled certain
path resolution requests. An authenticated user could possibly use this
issue to determine the existence of files outside of the root directory.
(CVE-2026-53422)
It was discovered that the Erlang SFTP server incorrectly handled extended
channel data, leading to an infinite loop. An authenticated user could
possibly use this issue to cause a denial of service. (CVE-2026-54886)
It was discovered that the Erlang DTLS server used a predictable cookie
secret on startup. A remote attacker could possibly use this issue to
bypass source address verification. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, U
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.8 |
| Ubuntu · 26.04 LTS 26.04:LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | erlang | 1:16.b.3-dfsg-1ubuntu2.2+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | erlang | 1:18.3-dfsg-1ubuntu3.1+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | erlang | 1:20.2.2+dfsg-1ubuntu2+esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | erlang | 1:22.2.7+dfsg-1ubuntu0.5+esm3 |
Vulnerabilities 30
-
Critical 9.3
TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension
Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes the client…
-
High 8.8
Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk. The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses…
-
High 8.7
DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions
Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtls_packet_dem…
-
High 8.3
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evalu…
-
High 8.2
TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension
The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls_handshake_1_3:handle_pre_shared_k…
-
High 8.2
Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rtt_ber:dec_subidentifiers/3 in …
-
High 7.6
OCSP designated-responder authorization bypass via missing signature verification
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in public_key:pkix_ocsp_validate/5 does not veri…
-
High 7.6
nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS…
-
High 7.5
KEX init error results with excessive memory usage
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algor…
-
High 7.5
Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist
Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distrib…
-
High 7.1
httpc leaks Authorization header to cross-origin redirect targets
Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the red…
-
High 7.1
SSH daemon allocates unbounded idle session channels, bypassing max_channels
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of ssh_connectio…
-
High 7.0
SSH SFTP packet size not verified properly in Erlang OTP
Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use componen…
-
High 7.0
Non-CA certificate accepted as intermediate issuer in public_key path validation
Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, p…
-
Medium 6.9
Pre-auth SSH DoS via unbounded zlib inflate
Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker…
-
Medium 6.9
Stack Buffer Overflow in ei_s_print_term at Very Large Integer
Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_p…
-
Medium 6.3
Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver
Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The built-in DNS resolver (inet_res) uses a sequential, process-global 16-bit transaction ID for UDP queries and does n…
-
Medium 6.3
OCSP responder certificate validity period not checked in public_key
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkey_ocsp:verify_response/5 and pubk…
-
Medium 6.3
ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks
Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_exten…
-
Medium 6.3
DTLS server cookie bypass during startup window due to empty initial cookie secret
Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 in…
-
Medium 6.3
Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later…
-
Medium 6.0
inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth
The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected d…
-
Medium 5.3
SFTP root escape via component-agnostic prefix check in ssh_sftpd
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:i…
-
Medium 5.3
SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon (ssh_sftpd) …
-
Medium 5.3
SSH SFTP server denial of service via extended channel data infinite loop
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause…
-
Medium 4.8
Absolute path traversal in zip:unzip/1,2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and progr…
-
Medium 4.8
Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks …
-
Low 2.3
TFTP Path Traversal
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is ass…
-
Low 2.3
SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filena…
-
Low 2.3
SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The SSH_FXP_REALPATH handler in ssh_sftpd calls rel…
References
-
report
https://ubuntu.com/security/CVE-2025-4748
-
report
https://ubuntu.com/security/CVE-2025-26618
-
report
https://ubuntu.com/security/CVE-2025-30211
-
report
https://ubuntu.com/security/CVE-2026-21620
-
report
https://ubuntu.com/security/CVE-2026-23942
-
report
https://ubuntu.com/security/CVE-2026-23943
-
report
https://ubuntu.com/security/CVE-2026-28808
-
report
https://ubuntu.com/security/CVE-2026-28810
-
report
https://ubuntu.com/security/CVE-2026-32144
-
report
https://ubuntu.com/security/CVE-2026-32147
-
report
https://ubuntu.com/security/CVE-2026-42789
-
report
https://ubuntu.com/security/CVE-2026-42790
-
report
https://ubuntu.com/security/CVE-2026-42791
-
report
https://ubuntu.com/security/CVE-2026-47078
-
report
https://ubuntu.com/security/CVE-2026-48855
-
report
https://ubuntu.com/security/CVE-2026-48856
-
report
https://ubuntu.com/security/CVE-2026-48858
-
report
https://ubuntu.com/security/CVE-2026-48860
-
report
https://ubuntu.com/security/CVE-2026-49759
-
report
https://ubuntu.com/security/CVE-2026-49760
-
report
https://ubuntu.com/security/CVE-2026-53422
-
report
https://ubuntu.com/security/CVE-2026-54886
-
report
https://ubuntu.com/security/CVE-2026-54887
-
report
https://ubuntu.com/security/CVE-2026-54891
-
report
https://ubuntu.com/security/CVE-2026-55950
-
report
https://ubuntu.com/security/CVE-2026-55952
-
report
https://ubuntu.com/security/CVE-2026-65634
-
report
https://ubuntu.com/security/CVE-2026-68956
-
report
https://ubuntu.com/security/CVE-2026-74994
-
report
https://ubuntu.com/security/CVE-2026-89422