CVE-2026-49760
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A stack-based buffer overflow exists in the erl_interface library of Erlang OTP in the ei_s_print_term function. It uses a 2000-character stack buffer that can overflow when formatting very large integers. Overflow bytes are limited to ASCII 0-9 and A-F, restricting exploitation to Denial of Service.
Risk Assessment
This vulnerability allows an attacker to cause a process crash (Denial of Service) by supplying a specially crafted Erlang term.
Recommendation
Update Erlang OTP to version 29.0.2, 28.5.0.2, or 27.3.4.13 (or later) and the corresponding erl_interface version.
Other vulnerabilities in Erlang OTP
See all- CVE-2026-28808Critical
In Erlang OTP (inets module), an incorrect authorization vulnerability exists. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory access controls against the DocumentRoot path while mod_cgi executes the script at the ScriptAlias path. This mismatch allows unauthenticated access to CGI scripts protected by directory rules.
- CVE-2026-23941Critical
In Erlang OTP (inets httpd module), an HTTP Request Smuggling vulnerability exists. The server does not reject or normalize duplicate Content-Length headers. The first value is used, while common proxies use the last, enabling front-end/back-end desynchronization and injection of attacker-controlled bytes as the start of the next request.
- CVE-2016-10253Critical
An issue was discovered in Erlang/OTP 18.x related to the generation of compiled regular expressions, which is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset used as an array index.
- CVE-2026-58227High
A vulnerability in the Erlang/OTP SSL application allows memory exhaustion by sending a crafted certificate chain during TLS/DTLS handshake. Lack of cycle detection in the certificate chain building function causes unbounded recursion, leading to BEAM node crash.
- CVE-2026-55953High
The TLS 1.2 (and earlier) and DTLS client in Erlang/OTP does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client. An on-path attacker can select an anonymous cipher suite, bypassing certificate and hostname verification, allowing interception and modification of traffic.
- CVE-2026-55737High
In Erlang OTP, a signed to unsigned conversion error and out-of-bounds heap write vulnerability exists when decoding a crafted ETF binary via binary_to_term/1. This can corrupt the BEAM heap pointer and crash the virtual machine.
- CVE-2026-54890High
A vulnerability in the External Term Format (ETF) decoder in ERTS causes an integer underflow when processing crafted binary data. This leads to allocating huge memory and crashing the entire Erlang/VM node.
- CVE-2026-47078Medium
In the zip module of Erlang OTP stdlib, a relative path traversal vulnerability allows writing files outside the intended extraction directory via a crafted zip archive. The zip:check_dir_level/2 function improperly validates paths containing ../ sequences.
- CVE-2026-42792High
In Erlang OTP (epmd), a connection slot exhaustion vulnerability allows an unauthenticated remote attacker to permanently terminate the epmd daemon. The do_accept function incorrectly treats EMFILE/ENFILE errors as fatal instead of recoverable.
- CVE-2026-55952High
Vulnerability in the Erlang/OTP ssl application. An unauthenticated attacker can send a crafted TLS 1.3 ClientHello, crashing the session ticket handler and making TLS 1.3 unusable until the ssl application is restarted.
Original NVD description (English source)
Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to erl_interface from 3.7.16 before 5.8.1, 5.7.0.1 and 5.5.2.1.