Loading vulnerability…
Erlang/OTP ETF Decoder Integer Underflow Denial of Service
CVE-2026-54890 is an integer underflow vulnerability in the Erlang/OTP erts External Term Format (ETF) decoder. The BIT_BINARY_EXT tag (77) handler accepts an encoding with both the length and trailing-bits fields set to zero. The subsequent unsigned bitstring-size calculation underflows, producing an enormous size that triggers an allocation failure and aborts the entire Erlang VM. Affected entry points include binary_to_term/1, binary_to_term/2, enif_binary_to_term(), and Erlang distribution term decoding. The vulnerability affects OTP releases beginning with 27.0 and is fixed in the respective release branches by OTP 27.3.4.15, 28.5.0.4, and 29.0.4.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A crafted ETF term can terminate an entire Erlang node, disrupting all applications and processes hosted by that VM rather than only the process decoding the input. The failure is a VM-level allocator abort, not an Erlang exception, so supervision trees and try/catch cannot contain it. The [safe] option to binary_to_term/2 does not prevent exploitation. The established impact is denial of service; code execution or confidentiality and integrity compromise are not established.
If you can’t patch tonight, do this now.
Prevent untrusted ETF data from reaching affected decoding functions until patched. Where ETF input must be accepted, perform structural validation before invoking the vulnerable decoder, including rejecting BIT_BINARY_EXT encodings with both length and trailing-bits fields set to zero. Restrict Erlang distribution to trusted networks and authorized peers, and limit access to application interfaces that decode ETF. Do not rely on binary_to_term/2's [safe] option, exception handling, or supervision trees as protection against this VM-level abort.
Patch, then assume compromise.
Upgrade to Erlang/OTP 27.3.4.15, 28.5.0.4, or 29.0.4, or a later fixed release in the applicable branch. The corresponding fixed erts versions are 15.2.7.11, 16.4.0.4, and 17.0.4. Alternatively, install the operating-system or product vendor's patched Erlang packages. Debian trixie provides a fix in erlang version 1:27.3.4.1+dfsg-1+deb13u3 or later. Ubuntu deployments should apply the applicable USN-8827-1 updates. Fixed VMware Tanzu RabbitMQ on Tanzu Platform releases include 2.4.6, 10.0.5, 10.1.4, and 10.4.3.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.