Erlang/OTP: Six Vulnerabilities Disclosed in Debian Packaging on July 29, 2026
Key findings • Six vulnerabilities disclosed on July 29, 2026, affect the Debian packaging of Erlang/OTP. • Flaws span multiple modules including public_key, ssl, stdlib, and erts. • Vuln…
Key findings
- Six vulnerabilities disclosed on July 29, 2026, affect the Debian packaging of Erlang/OTP.
- Flaws span multiple modules including public_key, ssl, stdlib, and erts.
- Vulnerabilities include denial of service, relative path traversal, and integer underflow.
- Exploitable issues could lead to resource exhaustion and arbitrary file writes.
- Users are urged to update to patched versions of Erlang/OTP.
On July 29, 2026, a batch of six vulnerabilities was disclosed for Erlang/OTP, affecting the Debian packaging of the Erlang runtime. These vulnerabilities span various components, including the public_key, ssl, and stdlib modules, with potential impacts ranging from denial of service to arbitrary file writes.
Several vulnerabilities center around the Erlang/OTP ssl application. CVE-2026-58227 describes a flaw where the ssl application fails to detect cycles when reconstructing an incomplete peer certificate chain during TLS or DTLS handshakes. This could be exploited by sending a crafted certificate chain. Additionally, CVE-2026-55953 highlights an issue where the ssl TLS 1.2 (and earlier) and DTLS client does not properly verify that the cipher suite selected by the server in the ServerHello message was among those offered by the client in the ClientHello. This could lead to the negotiation of an unexpected cipher suite.
Other vulnerabilities impact different modules within Erlang/OTP. CVE-2026-59251, found in the public_key module, allows for resource allocation without limits during certificate path validation, potentially leading to a denial of service via a crafted X.509 certificate chain. CVE-2026-47078, located in the stdlib zip module, is a relative path traversal vulnerability that permits writing files outside of the intended extraction directory through a specially crafted zip archive. CVE-2026-42792 affects the erts (epmd) component, where improper handling of exceptional conditions can lead to the permanent termination of the Erlang Port Mapper Daemon (epmd) through connection slot exhaustion. Finally, CVE-2026-54890, within the erts modules, is an integer underflow vulnerability that can result in forced integer overflow and excessive memory allocation.
The disclosed vulnerabilities were patched in the Debian packaging of Erlang/OTP. Users are advised to update to the latest available versions to mitigate these risks. The coordinated disclosure of these six CVEs on the same day indicates a focused effort to address multiple security weaknesses within the Erlang/OTP ecosystem.
This batch of vulnerabilities underscores the importance of maintaining up-to-date Erlang/OTP installations, particularly those packaged for Debian, to protect against potential denial of service, arbitrary file write, and resource exhaustion attacks.