Your message dated Thu, 30 Jul 2026 10:49:42 +0000
with message-id <[email protected]>
and subject line Bug#1142985: fixed in erlang 1:29.0.4+dfsg-1
has caused the Debian Bug report #1142985,
regarding erlang: CVE-2026-42792 CVE-2026-47078 CVE-2026-54890 CVE-2026-55737
CVE-2026-55953 CVE-2026-58227 CVE-2026-59250 CVE-2026-59251
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142985: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142985
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: erlang
Version: 1:29.0.3+dfsg-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for erlang.
CVE-2026-42792[0]:
| Improper Handling of Exceptional Conditions vulnerability in Erlang
| OTP erts (epmd) allows an unauthenticated remote attacker to
| permanently terminate the Erlang Port Mapper Daemon (epmd) via
| connection slot exhaustion. The do_accept function in
| erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2)
| returns EMFILE (per-process file descriptor limit reached) or ENFILE
| (system-wide file descriptor limit reached), rather than treating
| these as recoverable conditions. An attacker can exhaust epmd's file
| descriptor slots by holding many TCP connections open while
| periodically sending a single byte to reset the idle timeout, then
| causing accept(2) to return EMFILE, which kills the daemon. epmd has
| no per-source-IP connection cap, making the attack feasible from a
| single source. On Debian/Ubuntu default packaging the impact is
| amplified: the systemd unit inherits a low file descriptor soft
| limit, and repeated daemon deaths trigger systemd's start-rate-
| limit, permanently failing both epmd.service and epmd.socket and
| requiring manual operator intervention to recover. This issue
| affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and
| OTP 27.3.4.15.
CVE-2026-47078[1]:
| Relative Path Traversal vulnerability in Erlang OTP (stdlib zip
| module) allows writing files outside the intended extraction
| directory via a crafted zip archive. zip:unzip/1,2 and
| zip:extract/1,2 validate entry paths using zip:check_dir_level/2,
| which tracks directory depth as a running integer counter: ..
| decrements it, normal path components increment it. The caller
| rejects only paths where the final counter value is less than zero.
| A path such as ../x/y causes the counter to go negative mid-
| traversal then recover to zero, passing validation while resolving
| to a location outside the extraction directory when joined with the
| current working directory via add_cwd. This vulnerability is
| associated with program file lib/stdlib/src/zip.erl. This issue
| affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4 and
| OTP 27.3.4.15, corresponding to stdlib from 6.1 before 8.0.3,
| 7.3.0.1 and 6.2.2.4.
CVE-2026-54890[2]:
| Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp
| erlang/otp (erts modules), erlang otp erts (erts modules) allows
| Forced Integer Overflow, Excessive Allocation. This vulnerability is
| associated with program files erts/emulator/beam/external.c,
| emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in
| the External Term Format (ETF) decoder accepts an encoding with both
| length and trailing-bits fields set to zero. The subsequent
| computation of the bitstring size underflows an unsigned integer,
| producing a value of roughly 2^64 that is then passed as a memory
| allocation size. The allocator aborts the entire node with a message
| such as "Cannot allocate 2305843009213693951 bytes of memory (of
| type binary)". The crash is a VM-level abort, not an Erlang-level
| exception. It cannot be intercepted by supervision trees, by
| try/catch, or by passing the [safe] option to binary_to_term/2
| (which only restricts atom creation and does not perform structural
| validation of binary encodings). Any application that decodes ETF
| from untrusted sources via binary_to_term/1,2 or
| enif_binary_to_term() is exposed. The Erlang distribution protocol
| also decodes incoming terms through the same code path, but
| distribution is expected to run on trusted networks per the OTP
| Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP
| 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15,
| corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and
| 15.2.7.11.
CVE-2026-55737[3]:
| Signed to Unsigned Conversion Error and Out-of-bounds Write
| vulnerability in Erlang OTP erts allows an attacker who can supply a
| crafted Erlang external term format (ETF) binary to binary_to_term/1
| to corrupt the BEAM heap pointer and crash the virtual machine.
| When decoding a LARGE_TUPLE_EXT term, the validation pass
| decoded_size() in erts/emulator/beam/external.c reads the 32-bit
| arity field as unsigned (get_uint32()), while the decode pass
| dec_term() reads the same field as a signed 32-bit integer
| (get_int32()) into an int. An arity wire value of 0x80000000 passes
| validation as 2147483648 but decodes as -2147483648, so the
| subsequent hp += n moves the heap allocation pointer backward.
| Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL.
| The result is an out-of-bounds heap write; in practice the VM
| detects an impossible heap size and aborts, denying service. The
| required padding is large when uncompressed but the compressed-ETF
| envelope shrinks it to a small payload on the wire. This issue
| affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and
| OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4,
| 16.4.0.4 and 15.2.7.11.
CVE-2026-55953[4]:
| The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not
| verify that the cipher suite selected by the server in ServerHello
| was among the suites offered by the client in ClientHello. The
| client-side tls_handshake:hello/5 handler validates the negotiated
| protocol version and the downgrade sentinel but hands the server-
| chosen suite directly to
| ssl_handshake:handle_server_hello_extensions/9, which installs it
| without a membership check. The TLS 1.3 client path performs this
| check (per RFC 8446), so it is not affected. An on-path attacker
| between the client and the intended server can respond with a
| ServerHello selecting an anonymous key exchange suite such as
| TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered.
| Anonymous suites do not require the server to present a certificate,
| so the entire verify_peer and cacerts configuration is bypassed: the
| attacker completes the handshake with its own ephemeral parameters,
| no certificate is validated, no hostname is checked, and ssl:connect
| returns {ok, Socket}. All subsequent application traffic is readable
| and modifiable by the attacker. This issue affects OTP from OTP
| 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15,
| corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and
| 11.2.12.11.
CVE-2026-58227[5]:
| The Erlang/OTP ssl application does not detect cycles when
| reconstructing an incomplete peer certificate chain during a TLS or
| DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the
| received chain is passed to
| ssl_certificate:build_certificate_chain/5, which walks issuer
| relationships via ssl_certificate:do_certificate_chain/7 with no
| cycle detection and no depth limit. When the peer supplies two
| mutually cross-signed certificates in unordered form (A issues B, B
| issues A), the issuer lookup alternates between the two certificates
| and the pair of functions recurses indefinitely, growing the call
| stack and chain accumulator without bound. An unauthenticated
| remote attacker can send a crafted certificate chain in a TLS or
| DTLS Certificate handshake message to exhaust available memory and
| crash the BEAM node. Only a TCP connection and a partial handshake
| are required; no authentication or completed handshake is needed,
| and both TLS/DTLS servers and clients are affected when processing
| peer certificate messages. This issue affects OTP from OTP 23.2
| before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to
| ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11.
CVE-2026-59250[6]:
| Classic buffer overflow in the Erlang/OTP megaco flex scanner C
| driver allows a remote unauthenticated attacker to corrupt the
| driver's memory (and potentially achieve remote code execution or a
| denial-of-service crash) by sending a single text-encoded
| H.248/Megaco message containing an oversized property parm name.
| When tokenizing a Local/Remote descriptor, mfs_load_property_groups
| extracts the attacker-controlled property name (bounded only by the
| message length) and, when no value follows, formats it into a fixed
| 512-byte error_msg field of the MfsErlDrvData struct using an
| unchecked sprintf call. Names longer than roughly 452 bytes overflow
| into the immediately following struct fields (text_buf, text_ptr,
| term_spec, term_spec_size, term_spec_index), overwriting live
| pointers and counters with attacker-chosen bytes. Subsequent scanner
| code writes and frees through the corrupted pointers, producing
| arbitrary write and arbitrary free primitives inside the BEAM VM
| process, which can be leveraged for remote code execution. On builds
| compiled with _FORTIFY_SOURCE the overflow is detected at runtime
| and terminates the process with SIGABRT, resulting in denial of
| service. The overflow occurs in the flex scanner before any grammar
| or Megaco-level authentication processing, so exploitation requires
| only network reachability to the megaco transport port on a node
| configured with {scanner, flex}. This vulnerability is associated
| with program files
| lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program
| routines mfs_load_property_groups. This issue affects OTP from OTP
| 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15,
| corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and
| 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not
| listed because the OTP version scheme is only defined from OTP 17.0
| onwards.
CVE-2026-59251[7]:
| Allocation of resources without limits in Erlang/OTP public_key
| certificate path validation allows a remote unauthenticated attacker
| to cause denial of service by sending a crafted X.509 certificate
| chain during the TLS handshake. During RFC 5280 policy processing
| in public_key:pkix_path_validation/3, the certificate policy tree
| maintained by pubkey_policy_tree grows without an upper bound. When
| a certificate chain contains M policies per certificate and K
| certificates, the tree grows on the order of M^K nodes because
| pubkey_policy_tree:add_leaves/2 and
| pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy
| per certificate. A modest chain with many policies per certificate
| is enough to pin BEAM schedulers and exhaust the node's memory,
| taking down the entire VM. The attacker only needs to be able to
| present a certificate chain to the victim, which is the normal
| precondition for a TLS handshake, so exploitation succeeds against
| any incoming or outgoing TLS connection that validates the peer's
| chain (the default for SSL/TLS clients and mutual-TLS servers).
| This is the same vulnerability class as OpenSSL's X509_verify_cert
| policy tree DoS. This vulnerability is associated with program
| files lib/public_key/src/pubkey_policy_tree.erl and program routines
| pubkey_policy_tree:add_leaves/2 and
| pubkey_policy_tree:add_leaf_siblings/2. This issue affects OTP from
| OTP 26.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15,
| corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and
| 1.17.1.5.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-42792
https://www.cve.org/CVERecord?id=CVE-2026-42792
[1] https://security-tracker.debian.org/tracker/CVE-2026-47078
https://www.cve.org/CVERecord?id=CVE-2026-47078
[2] https://security-tracker.debian.org/tracker/CVE-2026-54890
https://www.cve.org/CVERecord?id=CVE-2026-54890
[3] https://security-tracker.debian.org/tracker/CVE-2026-55737
https://www.cve.org/CVERecord?id=CVE-2026-55737
[4] https://security-tracker.debian.org/tracker/CVE-2026-55953
https://www.cve.org/CVERecord?id=CVE-2026-55953
[5] https://security-tracker.debian.org/tracker/CVE-2026-58227
https://www.cve.org/CVERecord?id=CVE-2026-58227
[6] https://security-tracker.debian.org/tracker/CVE-2026-59250
https://www.cve.org/CVERecord?id=CVE-2026-59250
[7] https://security-tracker.debian.org/tracker/CVE-2026-59251
https://www.cve.org/CVERecord?id=CVE-2026-59251
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: erlang
Source-Version: 1:29.0.4+dfsg-1
Done: Sergei Golovan <[email protected]>
We believe that the bug you reported is fixed in the latest version of
erlang, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sergei Golovan <[email protected]> (supplier of updated erlang package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 30 Jul 2026 13:30:50 +0300
Source: erlang
Architecture: source
Version: 1:29.0.4+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Erlang Packagers <[email protected]>
Changed-By: Sergei Golovan <[email protected]>
Closes: 1142985
Changes:
erlang (1:29.0.4+dfsg-1) unstable; urgency=medium
.
* New upstream release.
- Fix CVE-2026-42792: Improper Handling of Exceptional Conditions
vulnerability in Erlang/OTP epmd daemon.
- Fix CVE-2026-47078: Relative Path Traversal vulnerability in Erlang/OTP
stdlib (zip module).
- Fix CVE-2026-54890: Integer Underflow (Wrap or Wraparound) vulnerability
in Erlang/OTP erts.
- Fix CVE-2026-55737: Signed to Unsigned Conversion Error and
Out-of-bounds Write vulnerability in Erlang/OTP erts.
- Fix CVE-2026-55953: The Erlang/OTP ssl TLS and DTLS client does not
verify that the cipher suite selected by the server in ServerHello
was among the suites offered by the client in ClientHello.
- Fix CVE-2026-58227: The Erlang/OTP ssl application does not detect
cycles when reconstructing an incomplete peer certificate chain during
a TLS or DTLS handshake.
- Fix CVE-2026-59250: Buffer overflow in the Erlang/OTP megaco flex
scanner C driver allows a remote unauthenticated attacker to corrupt
the driver's memory.
- Fix CVE-2026-59251: Allocation of resources without limits in Erlang/OTP
public_key certificate path validation allows a remote unauthenticated
attacker to cause denial of service.
Closes: #1142985.
Checksums-Sha1:
1fcb33549922e57f13958134d056ea833a3b8bfb 5002 erlang_29.0.4+dfsg-1.dsc
18fd9b9ac1a1280d415a28349592043c6bd6d6e0 49302664
erlang_29.0.4+dfsg.orig.tar.xz
d6351d4abf193b85b9c7cebb85e816852f4c6e15 62592
erlang_29.0.4+dfsg-1.debian.tar.xz
aae3e4af3f884fa88ce2ac5885b8ec5816e1b133 32348
erlang_29.0.4+dfsg-1_amd64.buildinfo
Checksums-Sha256:
15422d2f6ecaf33a97245144777b51ffa9a47027c84b4aced0fbc53416f730d1 5002
erlang_29.0.4+dfsg-1.dsc
50a470be38a51f8b5f05f4f788063e8823259ad2a2d9c7daa3b8d9b4ecbcc96c 49302664
erlang_29.0.4+dfsg.orig.tar.xz
acbf62e98f89c51c52dc2fedd9984cbacbcbff6fccee33b05496a5698133e84a 62592
erlang_29.0.4+dfsg-1.debian.tar.xz
4ccc509dcce66eb4e8c54eabec233cbedddd5190878608743fe64944384fe62d 32348
erlang_29.0.4+dfsg-1_amd64.buildinfo
Files:
cfea99dd9c950164a22610b041df87a3 5002 interpreters optional
erlang_29.0.4+dfsg-1.dsc
1500bd1fbdb8c4425c3928e0979c836b 49302664 interpreters optional
erlang_29.0.4+dfsg.orig.tar.xz
fe3e4e9d0cedebe8a01a306afc81463d 62592 interpreters optional
erlang_29.0.4+dfsg-1.debian.tar.xz
6f5383c561fafab1cd94e5241bfa3d15 32348 interpreters optional
erlang_29.0.4+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/SYPsyDB+ShSnvc4Tyrk60tj54cFAmprKckACgkQTyrk60tj
54ewiBAAoq1gWiJ4E7iCfvcIY19jrvp7J3lvS5IxNZvW66ymKaE6ZSYJAdHiDDWZ
VuFromSTMNc7RVJ0s+DDwr3l1ZYQOzN1weRTMBtf67jgUekUVcflBG0y4U8XuGXI
RGj41xe2ZzucNdWZ7S4vjQzco87QSpcRAZ1cedtWlvfPW5uwEioWYO6gPS0LSytb
m2nAUeDpEWn81DNuJV45IYxG/r3pmm3sBw+j9AA7e7TUA7RVz96oBDZ1gpUDxGjC
lwgtpp2j61N/foLg96YjA2Grqsa9G9KC7sD2T7npjHpJAb/FcxOPhKT+5eRh4WeL
fNBhQ+zOW7hpDefhG5B4WDZOBhSbCl8dEpRP+/Od6BZlNfPUfGS6/QHR1Tcn3em4
waVCDDuU/lOVK+W0X6npNd3qwn9c+T0qmIqfDUC7lNu1hl3Ho9EjRMP7CupgUkj3
oZSDchcTi4wFR0kL8CQ+c1TFaJSM6qXaDwx05pmkcSwKpLpV8GHr0rRgJL/YvUA9
uAXzsgeHFU1CpVP74cODHuuUwbfVTOrvtLGKGDJ0hFWsBpFMcTeV8Dk5pkFR67cH
R0eucWQcb1mekfwksyee3lRbMTKo+EMSmAlyoPzfGxr4Ire+mxy4+iI4T63yLLgN
LVwEgv9dm7w0VQ0xJ0rmF9Da2dK3nktLq4PJj7GNOUZGOrRxocc=
=DqJs
-----END PGP SIGNATURE-----
pgpGYiANXgMOt.pgp
Description: PGP signature
--- End Message ---
