Bug#1142985: erlang: CVE-2026-42792 CVE-2026-47078 CVE-2026-54890 CVE-2026-55737 CVE-2026-55953 CVE-2026-58227 CVE-2026-59250 CVE-2026-59251

Source: erlang
Version: 1:29.0.3+dfsg-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerabilities were published for erlang.

CVE-2026-42792[0]:
| Improper Handling of Exceptional Conditions vulnerability in Erlang
| OTP erts (epmd) allows an unauthenticated remote attacker to
| permanently terminate the Erlang Port Mapper Daemon (epmd) via
| connection slot exhaustion.  The do_accept function in
| erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2)
| returns EMFILE (per-process file descriptor limit reached) or ENFILE
| (system-wide file descriptor limit reached), rather than treating
| these as recoverable conditions. An attacker can exhaust epmd's file
| descriptor slots by holding many TCP connections open while
| periodically sending a single byte to reset the idle timeout, then
| causing accept(2) to return EMFILE, which kills the daemon. epmd has
| no per-source-IP connection cap, making the attack feasible from a
| single source.  On Debian/Ubuntu default packaging the impact is
| amplified: the systemd unit inherits a low file descriptor soft
| limit, and repeated daemon deaths trigger systemd's start-rate-
| limit, permanently failing both epmd.service and epmd.socket and
| requiring manual operator intervention to recover.  This issue
| affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and
| OTP 27.3.4.15.


CVE-2026-47078[1]:
| Relative Path Traversal vulnerability in Erlang OTP (stdlib zip
| module) allows writing files outside the intended extraction
| directory via a crafted zip archive.  zip:unzip/1,2 and
| zip:extract/1,2 validate entry paths using zip:check_dir_level/2,
| which tracks directory depth as a running integer counter: ..
| decrements it, normal path components increment it. The caller
| rejects only paths where the final counter value is less than zero.
| A path such as ../x/y causes the counter to go negative mid-
| traversal then recover to zero, passing validation while resolving
| to a location outside the extraction directory when joined with the
| current working directory via add_cwd.  This vulnerability is
| associated with program file lib/stdlib/src/zip.erl.  This issue
| affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4 and
| OTP 27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3,
| 7.3.0.1 and 6.2.2.4.


CVE-2026-54890[2]:
| Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp
| erlang/otp (erts modules), erlang otp erts (erts modules) allows
| Forced Integer Overflow, Excessive Allocation. This vulnerability is
| associated with program files erts/emulator/beam/external.c,
| emulator/beam/external.c.  The BIT_BINARY_EXT tag (77) handler in
| the External Term Format (ETF) decoder accepts an encoding with both
| length and trailing-bits fields set to zero. The subsequent
| computation of the bitstring size underflows an unsigned integer,
| producing a value of roughly 2^64 that is then passed as a memory
| allocation size. The allocator aborts the entire node with a message
| such as "Cannot allocate 2305843009213693951 bytes of memory (of
| type binary)".  The crash is a VM-level abort, not an Erlang-level
| exception. It cannot be intercepted by supervision trees, by
| try/catch, or by passing the [safe] option to binary_to_term/2
| (which only restricts atom creation and does not perform structural
| validation of binary encodings).  Any application that decodes ETF
| from untrusted sources via binary_to_term/1,2 or
| enif_binary_to_term() is exposed. The Erlang distribution protocol
| also decodes incoming terms through the same code path, but
| distribution is expected to run on trusted networks per the OTP
| Secure Coding Guidelines (DSG-011).  This issue affects OTP from OTP
| 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15,
| corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and
| 15.2.7.11.


CVE-2026-55737[3]:
| Signed to Unsigned Conversion Error and Out-of-bounds Write
| vulnerability in Erlang OTP erts allows an attacker who can supply a
| crafted Erlang external term format (ETF) binary to binary_to_term/1
| to corrupt the BEAM heap pointer and crash the virtual machine.
| When decoding a LARGE_TUPLE_EXT term, the validation pass
| decoded_size() in erts/emulator/beam/external.c reads the 32-bit
| arity field as unsigned (get_uint32()), while the decode pass
| dec_term() reads the same field as a signed 32-bit integer
| (get_int32()) into an int. An arity wire value of 0x80000000 passes
| validation as 2147483648 but decodes as -2147483648, so the
| subsequent hp += n moves the heap allocation pointer backward.
| Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL.
| The result is an out-of-bounds heap write; in practice the VM
| detects an impossible heap size and aborts, denying service. The
| required padding is large when uncompressed but the compressed-ETF
| envelope shrinks it to a small payload on the wire.  This issue
| affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and
| OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4,
| 16.4.0.4 and 15.2.7.11.


CVE-2026-55953[4]:
| The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not
| verify that the cipher suite selected by the server in ServerHello
| was among the suites offered by the client in ClientHello. The
| client-side tls_handshake:hello/5 handler validates the negotiated
| protocol version and the downgrade sentinel but hands the server-
| chosen suite directly to
| ssl_handshake:handle_server_hello_extensions/9, which installs it
| without a membership check. The TLS 1.3 client path performs this
| check (per RFC 8446), so it is not affected.  An on-path attacker
| between the client and the intended server can respond with a
| ServerHello selecting an anonymous key exchange suite such as
| TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered.
| Anonymous suites do not require the server to present a certificate,
| so the entire verify_peer and cacerts configuration is bypassed: the
| attacker completes the handshake with its own ephemeral parameters,
| no certificate is validated, no hostname is checked, and ssl:connect
| returns {ok, Socket}. All subsequent application traffic is readable
| and modifiable by the attacker.  This issue affects OTP from OTP
| 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15,
| corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and
| 11.2.12.11.


CVE-2026-58227[5]:
| The Erlang/OTP ssl application does not detect cycles when
| reconstructing an incomplete peer certificate chain during a TLS or
| DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the
| received chain is passed to
| ssl_certificate:build_certificate_chain/5, which walks issuer
| relationships via ssl_certificate:do_certificate_chain/7 with no
| cycle detection and no depth limit. When the peer supplies two
| mutually cross-signed certificates in unordered form (A issues B, B
| issues A), the issuer lookup alternates between the two certificates
| and the pair of functions recurses indefinitely, growing the call
| stack and chain accumulator without bound.  An unauthenticated
| remote attacker can send a crafted certificate chain in a TLS or
| DTLS Certificate handshake message to exhaust available memory and
| crash the BEAM node. Only a TCP connection and a partial handshake
| are required; no authentication or completed handshake is needed,
| and both TLS/DTLS servers and clients are affected when processing
| peer certificate messages.  This issue affects OTP from OTP 23.2
| before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to
| ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11.


CVE-2026-59250[6]:
| Classic buffer overflow in the Erlang/OTP megaco flex scanner C
| driver allows a remote unauthenticated attacker to corrupt the
| driver's memory (and potentially achieve remote code execution or a
| denial-of-service crash) by sending a single text-encoded
| H.248/Megaco message containing an oversized property parm name.
| When tokenizing a Local/Remote descriptor, mfs_load_property_groups
| extracts the attacker-controlled property name (bounded only by the
| message length) and, when no value follows, formats it into a fixed
| 512-byte error_msg field of the MfsErlDrvData struct using an
| unchecked sprintf call. Names longer than roughly 452 bytes overflow
| into the immediately following struct fields (text_buf, text_ptr,
| term_spec, term_spec_size, term_spec_index), overwriting live
| pointers and counters with attacker-chosen bytes. Subsequent scanner
| code writes and frees through the corrupted pointers, producing
| arbitrary write and arbitrary free primitives inside the BEAM VM
| process, which can be leveraged for remote code execution. On builds
| compiled with _FORTIFY_SOURCE the overflow is detected at runtime
| and terminates the process with SIGABRT, resulting in denial of
| service.  The overflow occurs in the flex scanner before any grammar
| or Megaco-level authentication processing, so exploitation requires
| only network reachability to the megaco transport port on a node
| configured with {scanner, flex}.  This vulnerability is associated
| with program files
| lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program
| routines mfs_load_property_groups.  This issue affects OTP from OTP
| 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15,
| corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and
| 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not
| listed because the OTP version scheme is only defined from OTP 17.0
| onwards.


CVE-2026-59251[7]:
| Allocation of resources without limits in Erlang/OTP public_key
| certificate path validation allows a remote unauthenticated attacker
| to cause denial of service by sending a crafted X.509 certificate
| chain during the TLS handshake.  During RFC 5280 policy processing
| in public_key:pkix_path_validation/3, the certificate policy tree
| maintained by pubkey_policy_tree grows without an upper bound. When
| a certificate chain contains M policies per certificate and K
| certificates, the tree grows on the order of M^K nodes because
| pubkey_policy_tree:add_leaves/2 and
| pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy
| per certificate. A modest chain with many policies per certificate
| is enough to pin BEAM schedulers and exhaust the node's memory,
| taking down the entire VM. The attacker only needs to be able to
| present a certificate chain to the victim, which is the normal
| precondition for a TLS handshake, so exploitation succeeds against
| any incoming or outgoing TLS connection that validates the peer's
| chain (the default for SSL/TLS clients and mutual-TLS servers).
| This is the same vulnerability class as OpenSSL's X509_verify_cert
| policy tree DoS.  This vulnerability is associated with program
| files lib/public_key/src/pubkey_policy_tree.erl and program routines
| pubkey_policy_tree:add_leaves/2 and
| pubkey_policy_tree:add_leaf_siblings/2.  This issue affects OTP from
| OTP 26.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15,
| corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and
| 1.17.1.5.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-42792
    https://www.cve.org/CVERecord?id=CVE-2026-42792
[1] https://security-tracker.debian.org/tracker/CVE-2026-47078
    https://www.cve.org/CVERecord?id=CVE-2026-47078
[2] https://security-tracker.debian.org/tracker/CVE-2026-54890
    https://www.cve.org/CVERecord?id=CVE-2026-54890
[3] https://security-tracker.debian.org/tracker/CVE-2026-55737
    https://www.cve.org/CVERecord?id=CVE-2026-55737
[4] https://security-tracker.debian.org/tracker/CVE-2026-55953
    https://www.cve.org/CVERecord?id=CVE-2026-55953
[5] https://security-tracker.debian.org/tracker/CVE-2026-58227
    https://www.cve.org/CVERecord?id=CVE-2026-58227
[6] https://security-tracker.debian.org/tracker/CVE-2026-59250
    https://www.cve.org/CVERecord?id=CVE-2026-59250
[7] https://security-tracker.debian.org/tracker/CVE-2026-59251
    https://www.cve.org/CVERecord?id=CVE-2026-59251

Regards,
Salvatore