CVE-2026-55737
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Erlang OTP, a signed to unsigned conversion error and out-of-bounds heap write vulnerability exists when decoding a crafted ETF binary via binary_to_term/1. This can corrupt the BEAM heap pointer and crash the virtual machine.
Risk Assessment
An attacker can cause denial of service by crashing the Erlang virtual machine.
Recommendation
Upgrade Erlang OTP to version 29.0.4, 28.5.0.4, or 27.3.4.15 depending on the branch used.
Other vulnerabilities in Erlang OTP
See all- CVE-2026-28808Critical
In Erlang OTP (inets module), an incorrect authorization vulnerability exists. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory access controls against the DocumentRoot path while mod_cgi executes the script at the ScriptAlias path. This mismatch allows unauthenticated access to CGI scripts protected by directory rules.
- CVE-2026-23941Critical
In Erlang OTP (inets httpd module), an HTTP Request Smuggling vulnerability exists. The server does not reject or normalize duplicate Content-Length headers. The first value is used, while common proxies use the last, enabling front-end/back-end desynchronization and injection of attacker-controlled bytes as the start of the next request.
- CVE-2016-10253Critical
An issue was discovered in Erlang/OTP 18.x related to the generation of compiled regular expressions, which is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset used as an array index.
- CVE-2026-58227High
A vulnerability in the Erlang/OTP SSL application allows memory exhaustion by sending a crafted certificate chain during TLS/DTLS handshake. Lack of cycle detection in the certificate chain building function causes unbounded recursion, leading to BEAM node crash.
- CVE-2026-55953High
The TLS 1.2 (and earlier) and DTLS client in Erlang/OTP does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client. An on-path attacker can select an anonymous cipher suite, bypassing certificate and hostname verification, allowing interception and modification of traffic.
- CVE-2026-54890High
A vulnerability in the External Term Format (ETF) decoder in ERTS causes an integer underflow when processing crafted binary data. This leads to allocating huge memory and crashing the entire Erlang/VM node.
- CVE-2026-47078Medium
In the zip module of Erlang OTP stdlib, a relative path traversal vulnerability allows writing files outside the intended extraction directory via a crafted zip archive. The zip:check_dir_level/2 function improperly validates paths containing ../ sequences.
- CVE-2026-42792High
In Erlang OTP (epmd), a connection slot exhaustion vulnerability allows an unauthenticated remote attacker to permanently terminate the epmd daemon. The do_accept function incorrectly treats EMFILE/ENFILE errors as fatal instead of recoverable.
- CVE-2026-55952High
Vulnerability in the Erlang/OTP ssl application. An unauthenticated attacker can send a crafted TLS 1.3 ClientHello, crashing the session ticket handler and making TLS 1.3 unusable until the ssl application is restarted.
- CVE-2026-55950Medium
TOCTOU race condition in the ssl module (dtls_packet_demux) in Erlang/OTP. An unauthenticated remote attacker can send multiple ClientHello messages from the same source, causing a race and crash of the demux process, terminating all active DTLS sessions on that listener. The attack is repeatable and requires no authentication.
Original NVD description (English source)
Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.