An update for erlang is now available for openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3464 Final 1.0 1.0 2026-08-20 Initial 2026-08-20 2026-08-20 openEuler SA Tool V1.0 2026-08-20 erlang security update An update for erlang is now available for openEuler-24.03-LTS-SP3 Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fix(es): Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source. On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15.(CVE-2026-42792) Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.(CVE-2026-55737) The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP R13B03 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl from 3.10.7 before 11.2.12.11, from 11.3 before 11.6.0.4, and from 11.7 before 11.7.4. Whether OTP before OTP R13B03, corresponding to ssl before 3.10.7, is affected is unknown.(CVE-2026-55953) The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound. An unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS Certificate handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages. This issue affects OTP from OTP 23.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11.(CVE-2026-58227) Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service. The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}. This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards.(CVE-2026-59250) An update for erlang is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High erlang https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3464 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-42792 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-55737 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-55953 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-58227 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59250 https://nvd.nist.gov/vuln/detail/CVE-2026-42792 https://nvd.nist.gov/vuln/detail/CVE-2026-55737 https://nvd.nist.gov/vuln/detail/CVE-2026-55953 https://nvd.nist.gov/vuln/detail/CVE-2026-58227 https://nvd.nist.gov/vuln/detail/CVE-2026-59250 openEuler-24.03-LTS-SP3 erlang-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-asn1-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-common_test-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-compiler-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-crypto-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-debugger-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-debuginfo-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-debugsource-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-dialyzer-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-diameter-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-edoc-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-eldap-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-erl_docgen-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-erl_interface-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-erts-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-et-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-eunit-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-examples-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-ftp-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-inets-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-jinterface-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-kernel-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-megaco-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-mnesia-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-observer-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-odbc-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-os_mon-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-parsetools-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-public_key-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-reltool-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-runtime_tools-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-sasl-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-snmp-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-src-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-ssh-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-ssl-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-stdlib-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-syntax_tools-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-tftp-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-tools-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-wx-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-xmerl-25.3.2.6-19.oe2403sp3.aarch64.rpm erlang-25.3.2.6-19.oe2403sp3.src.rpm erlang-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-asn1-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-common_test-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-compiler-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-crypto-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-debugger-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-debuginfo-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-debugsource-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-dialyzer-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-diameter-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-edoc-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-eldap-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-erl_docgen-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-erl_interface-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-erts-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-et-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-eunit-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-examples-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-ftp-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-inets-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-jinterface-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-kernel-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-megaco-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-mnesia-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-observer-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-odbc-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-os_mon-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-parsetools-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-public_key-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-reltool-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-runtime_tools-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-sasl-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-snmp-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-src-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-ssh-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-ssl-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-stdlib-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-syntax_tools-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-tftp-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-tools-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-wx-25.3.2.6-19.oe2403sp3.x86_64.rpm erlang-xmerl-25.3.2.6-19.oe2403sp3.x86_64.rpm Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source. On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15. 2026-08-20 CVE-2026-42792 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H erlang security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3464 Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11. 2026-08-20 CVE-2026-55737 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H erlang security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3464 The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP R13B03 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl from 3.10.7 before 11.2.12.11, from 11.3 before 11.6.0.4, and from 11.7 before 11.7.4. Whether OTP before OTP R13B03, corresponding to ssl before 3.10.7, is affected is unknown. 2026-08-20 CVE-2026-55953 openEuler-24.03-LTS-SP3 High 7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N erlang security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3464 The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound. An unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS Certificate handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages. This issue affects OTP from OTP 23.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11. 2026-08-20 CVE-2026-58227 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H erlang security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3464 Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service. The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}. This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards. 2026-08-20 CVE-2026-59250 openEuler-24.03-LTS-SP3 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H erlang security update 2026-08-20 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3464