Loading story…
Erlang/OTP users were urged to patch after multiple vulnerabilities were disclosed across the platform, including high-severity flaws that can crash BEAM nodes or exhaust resources during normal protocol handling. CVE-2026-59251 affects public_key certificate path validation, where a crafted X.509 chain can trigger exponential certificate policy tree growth during a TLS handshake and consume CPU and memory until the VM fails. CVE-2026-58227 affects the ssl application, where mutually cross-signed certificates can cause unbounded recursion while rebuilding incomplete TLS or DTLS peer chains, allowing an unauthenticated attacker to crash either servers or clients before authentication completes.
A separate high-severity flaw, CVE-2026-54890, impacts the erts External Term Format decoder used by binary_to_term/1, binary_to_term/2, and enif_binary_to_term(), where an integer underflow in BIT_BINARY_EXT decoding can trigger near-2^64 memory allocation and terminate the entire Erlang VM. National cyber authorities in Canada and Italy published advisories directing administrators to review Erlang security bulletins and update affected releases, while the Italian notice said the broader disclosure set includes additional Erlang/OTP issues spanning denial of service, remote code execution, authentication bypass, and security feature bypass. Fixed versions cited across the disclosures include 27.3.4.15, 28.5.0.4, and 29.0.4.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Italy's national cybersecurity agency reported multiple newly identified Erlang/OTP vulnerabilities, including one critical and four high-severity issues affecting components such as ssl, tls_handshake, pubkey_policy_tree, and erts. The agency recommended updating vulnerable products in line with vendor security bulletins.
The Canadian Centre for Cyber Security published advisory AV26-750 warning that Erlang is affected by vulnerabilities in certain OTP versions and recommending that administrators review the Erlang/OTP security advisory and apply updates. The notice states the affected versions as of July 27, 2026.
Security advisories describe patched Erlang/OTP releases 27.3.4.15, 28.5.0.4, and 29.0.4 for multiple flaws, including certificate policy tree growth in public_key, recursive certificate-chain handling in ssl, and an integer underflow in erts ETF decoding. The issues can allow remote denial of service or VM crashes in affected versions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Erlang/OTP disclosed **CVE-2026-49759**, a high-severity stack buffer overflow in the `inet_drv` SCTP error-cause parsing path that can let an unauthenticated remote attacker crash the BEAM VM. The flaw is in `sctp_parse_error_chunk` in `erts/emulator/drivers/common/inet_drv.c`, where crafted SCTP `ERROR` chunks can overflow a fixed-size stack buffer while cause codes are converted into `ErlDrvTermData` entries. Exploitation requires SCTP support to be enabled, a listening SCTP socket to be exposed through `gen_sctp` using the default `inet` backend, and network reachability to that port; Windows builds are not affected because SCTP is unsupported there. Advisories and the upstream patch indicate the issue is primarily **denial of service**, not expected remote code execution, because stack protections should terminate the process before meaningful control of execution is possible and the overwrite pattern is constrained. A crafted packet may also leak limited Erlang VM memory in an error response. The vulnerability affects OTP releases from **17.0** up to but excluding **27.3.4.13**, **28.5.0.2**, and **29.0.2**. The fix adds bounds checking and truncation safeguards in SCTP parsing and related async-event handling to prevent output term buffer overruns during malformed packet processing.
Jun 29, 2026
Two high-severity denial-of-service vulnerabilities in Erlang/OTP's **`ssl`** application allow unauthenticated remote attackers to disrupt secure listeners before authentication completes. **`CVE-2026-55950`** affects the DTLS **`dtls_packet_demux`** component, where a time-of-check/time-of-use race condition can be triggered by rapidly sending multiple DTLS `ClientHello` messages from the same source IP address and port. Because the demultiplexing process is shared across DTLS associations on a listener, a successful crash terminates **all active DTLS sessions** on that listener rather than only the attacker's connection. A second flaw, **`CVE-2026-55952`**, affects **TLS 1.3** servers when malformed `ClientHello` pre-shared key data causes session ticket handling to crash after the software fails to validate that PSK identity and binder lists are the same length. A single crafted request can make TLS 1.3 unusable on an affected listener until the **`ssl`** application is restarted, while TLS 1.2 is not affected. Erlang/OTP maintainers released fixes in **OTP `29.0.3`**, **`28.5.0.3`**, and **`27.3.4.14`**; the DTLS issue was addressed in a GitHub commit that changed logic in **`dtls_packet_demux.erl`** to safely handle existing keys during connection state transitions.
Jul 12, 2026
A critical vulnerability tracked as **`CVE-2026-55953`** affects Erlang/OTP SSL clients using **TLS 1.2 and earlier** as well as **DTLS**, allowing an on-path attacker to bypass server authentication and intercept supposedly secure sessions. The flaw occurs because the client does not verify that the cipher suite selected by the server was actually offered in the `ClientHello`, enabling an attacker to force an anonymous cipher suite and complete the handshake without certificate validation or hostname checking. Once the connection is established, the attacker can read and modify traffic; **TLS 1.3 is not affected** because it already performs the required cipher-suite membership check. The issue affects Erlang/OTP from **`OTP 17.0`** up to the patched releases **`27.3.4.15`**, **`28.5.0.4`**, and **`29.0.4`**, with corresponding SSL fixes in **`11.2.12.11`**, **`11.6.0.4`**, and **`11.7.4`**. Erlang/OTP maintainers addressed the bug in July with code changes to `ssl_handshake.erl` that add a pre-TLS 1.3 client cipher-suite validation check and trigger a fatal `illegal_parameter` alert if the negotiated suite was not advertised by the client. The vulnerability carries a **CVSS 4.0 score of 9.1** and is classified under **`CWE-757`**.
Jul 28, 2026