CVE-2026-55737
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Erlang OTP, a signed to unsigned conversion error and out-of-bounds heap write vulnerability exists when decoding a crafted ETF binary via binary_to_term/1. This can corrupt the BEAM heap pointer and crash the virtual machine.
Risk Assessment
An attacker can cause denial of service by crashing the Erlang virtual machine.
Recommendation
Upgrade Erlang OTP to version 29.0.4, 28.5.0.4, or 27.3.4.15 depending on the branch used.
Other vulnerabilities in Erlang OTP
See all- CVE-2026-28808Critical
An incorrect authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. The path mismatch between access control evaluation and script execution allows bypassing protections.
- CVE-2026-23941Critical
In Erlang OTP (inets httpd module), an HTTP Request Smuggling vulnerability exists. The server does not reject or normalize duplicate Content-Length headers. The first value is used, while common proxies use the last, enabling front-end/back-end desynchronization and injection of attacker-controlled bytes as the start of the next request.
- CVE-2025-32433CriticalActively exploited
Erlang/OTP prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20 contains a vulnerability in the SSH server that may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access and execute arbitrary commands without valid credentials.
- CVE-2016-10253Critical
An issue was discovered in Erlang/OTP 18.x related to the generation of compiled regular expressions, which is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset used as an array index.
- CVE-2026-75538High
In Erlang/OTP, when using the inet driver with {packet,4} mode, an attacker connecting to an open TCP port can exploit a signed overflow in packet length calculation, potentially overflowing the receive buffer and crashing the BEAM VM.
- CVE-2026-74835High
The httpd HTTP server in the inets application fails to enforce a configured body-size limit on chunked requests. This may allow sending very large requests, potentially leading to server overload.
- CVE-2026-73812High
The check_header/3 function in httpd rejects duplicate Content-Length but does not check for the co-presence of Transfer-Encoding and Content-Length, which can lead to request smuggling desynchronization between front-end and back-end.
- CVE-2026-73276High
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
- CVE-2026-58227High
A vulnerability in the Erlang/OTP SSL application allows memory exhaustion by sending a crafted certificate chain during TLS/DTLS handshake. Lack of cycle detection in the certificate chain building function causes unbounded recursion, leading to BEAM node crash.
- CVE-2026-55953High
The TLS 1.2 (and earlier) and DTLS client in Erlang/OTP does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client. An on-path attacker can select an anonymous cipher suite, bypassing certificate and hostname verification, allowing interception and modification of traffic.
Original NVD description (English source)
Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS