Loading story…
Erlang/OTP disclosed CVE-2026-49759, a high-severity stack buffer overflow in the inet_drv SCTP error-cause parsing path that can let an unauthenticated remote attacker crash the BEAM VM. The flaw is in sctp_parse_error_chunk in erts/emulator/drivers/common/inet_drv.c, where crafted SCTP ERROR chunks can overflow a fixed-size stack buffer while cause codes are converted into ErlDrvTermData entries. Exploitation requires SCTP support to be enabled, a listening SCTP socket to be exposed through gen_sctp using the default inet backend, and network reachability to that port; Windows builds are not affected because SCTP is unsupported there.
Advisories and the upstream patch indicate the issue is primarily denial of service, not expected remote code execution, because stack protections should terminate the process before meaningful control of execution is possible and the overwrite pattern is constrained. A crafted packet may also leak limited Erlang VM memory in an error response. The vulnerability affects OTP releases from 17.0 up to but excluding 27.3.4.13, 28.5.0.2, and 29.0.2. The fix adds bounds checking and truncation safeguards in SCTP parsing and related async-event handling to prevent output term buffer overruns during malformed packet processing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A CNA record was published for CVE-2026-49759 describing a stack buffer overflow in SCTP error cause parsing in inet_drv that allows a remote VM crash.
On 2026-06-10, Erlang published security advisories covering multiple vulnerabilities across OTP and related components, including the SCTP inet_drv overflow, a Distribution-over-TLS LAN allowlist bypass, and an httpc flaw that can leak Authorization headers on cross-origin redirects. The notice identified affected and fixed versions for OTP, erts, inets, and ssl, and urged administrators to apply updates.
OSV and CVE feed entries published vulnerability details and affected version ranges, including fixes in OTP 27.3.4.13, 28.5.0.2, and 29.0.2, and characterized the issue primarily as denial of service.
A GitHub security advisory disclosed that a remote unauthenticated attacker could crash the Erlang BEAM VM with a crafted SCTP ERROR chunk under specific SCTP-enabled conditions, and noted limited memory disclosure and that Windows is unaffected.
A code change in erlang/otp introduced buffer-size tracking and truncation logic to protect the output term buffer during SCTP error and async event parsing, addressing the overflow condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourceosv.dev
Open sourcegithub.com
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcecna.erlef.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **`CVE-2026-15422`** was disclosed in the illumos SCTP stack, where improper validation of `INIT ACK` chunk address parameters can let a remote, unauthenticated attacker trigger kernel heap corruption and potentially achieve remote code execution. The flaw affects the SCTP inbound path because association lookup for `INIT ACK` traffic occurs before SCTP integrity checks and before IPsec policy is applied, expanding exposure for systems that process crafted network packets. The issue has reportedly existed since a 2010 `illumos-gate` commit and impacts illumos-based platforms including downstream distributions such as **SmartOS**.
Jul 17, 2026
Two high-severity denial-of-service vulnerabilities in Erlang/OTP's **`ssl`** application allow unauthenticated remote attackers to disrupt secure listeners before authentication completes. **`CVE-2026-55950`** affects the DTLS **`dtls_packet_demux`** component, where a time-of-check/time-of-use race condition can be triggered by rapidly sending multiple DTLS `ClientHello` messages from the same source IP address and port. Because the demultiplexing process is shared across DTLS associations on a listener, a successful crash terminates **all active DTLS sessions** on that listener rather than only the attacker's connection. A second flaw, **`CVE-2026-55952`**, affects **TLS 1.3** servers when malformed `ClientHello` pre-shared key data causes session ticket handling to crash after the software fails to validate that PSK identity and binder lists are the same length. A single crafted request can make TLS 1.3 unusable on an affected listener until the **`ssl`** application is restarted, while TLS 1.2 is not affected. Erlang/OTP maintainers released fixes in **OTP `29.0.3`**, **`28.5.0.3`**, and **`27.3.4.14`**; the DTLS issue was addressed in a GitHub commit that changed logic in **`dtls_packet_demux.erl`** to safely handle existing keys during connection state transitions.
Jul 12, 2026
Erlang/OTP disclosed **CVE-2025-32433** in its SSH implementation as an **unauthenticated remote code execution** vulnerability, tracked in GitHub advisory `GHSA-37cp-fgq5-7wc2`. Public descriptions characterize the issue as a **pre-authentication** flaw tied to improper handling of SSH protocol messages, including malformed `SSH_MSG_CHANNEL_REQUEST` packets, allowing attackers to execute code on exposed Erlang-based SSH servers without valid credentials. Several repositories also describe the weakness as related to missing authentication for a critical function (`CWE-306`). After disclosure, GitHub saw a rapid spread of public exploit material, including proof-of-concept code, remote shell implementations, offensive modules, lab-focused exploit scripts, and later detection tooling. Repositories from multiple authors published exploit variants in Go and other formats, along with testing tools for identifying vulnerable systems, indicating that exploitation knowledge quickly became broadly accessible to both defenders and attackers. The volume and persistence of these repositories suggest that organizations running Erlang/OTP SSH services faced elevated risk of opportunistic scanning and weaponized exploitation soon after the advisory became public.
Jul 23, 2026