Loading vulnerability…
Erlang/OTP SCTP Error Parsing Stack Buffer Overflow
CVE-2026-49759 is a stack-based buffer overflow in the Erlang/OTP runtime's inet_drv SCTP error parsing. The sctp_parse_error_chunk function writes error cause codes into a fixed-size, stack-allocated ErlDrvTermData spec[] array without bounds checking. An unauthenticated remote attacker with an established SCTP association can send a single SCTP ERROR chunk containing enough cause codes to overflow the array and crash the BEAM VM. Attacker-controlled writes are restricted to 16-bit values interleaved with a fixed tag, preventing a controlled return-address overwrite and limiting exploitation to denial of service. A crafted chunk may also expose fragments of VM memory to the receiving Erlang process. Affected releases begin with OTP 17.0, corresponding to erts 6.0; branch-specific fixes are available in OTP 27.3.4.13, 28.5.0.2, and 29.0.2. The status of earlier releases is unknown. Windows builds are unaffected because they do not support SCTP.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation crashes the entire BEAM VM, interrupting applications and services hosted by that runtime. Limited fragments of VM memory may also appear in the error data delivered to the receiving Erlang process; this does not establish remote exfiltration, and the disclosed memory is already readable by the operating-system user running the VM. The constrained overwrite does not provide controlled code execution.
If you can’t patch tonight, do this now.
Until patched, restrict network access to affected SCTP listening ports to trusted peers using firewall rules or network segmentation. Disable unnecessary SCTP listeners or avoid deploying SCTP-enabled Erlang runtimes where SCTP is not required. These exposure-reduction measures do not correct the underlying bounds-checking flaw.
Patch, then assume compromise.
Upgrade to Erlang/OTP 27.3.4.13, 28.5.0.2, or 29.0.2, or a later fixed release in the applicable branch. Corresponding fixed erts versions are 15.2.7.9, 16.4.0.2, and 17.0.2. For Debian stable (trixie), install erlang version 1:27.3.4.1+dfsg-1+deb13u3 or later through Debian security updates. Affected HPE Networking Private 5G Core deployments should upgrade to version 1.26.2.0 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.