CVE-2026-21620 Erlang CVE debrief

Who should care

Users of Erlang OTP, particularly those using versions prior to OTP 28.3.2, OTP 27.3.4.8, and OTP 26.2.5.17, should be aware of this vulnerability. This includes developers and administrators who utilize Erlang OTP in their applications or infrastructure.

Technical summary

The CVE-2026-21620 vulnerability is classified as a Relative Path Traversal issue within the tftp_file modules of Erlang OTP. This vulnerability has a CVSS score of 2.3 and is considered to have a Low severity. The affected components include erlang/otp, erlang otp inets, and erlang otp tftp. The vulnerability is associated with CWE-23. The issue was published on 2026-02-20T11:15:56.783Z and last modified on 2026-07-24T15:17:13.700Z.

Defensive priority

Given the Low severity and CVSS score of 2.3, this vulnerability should be addressed in the context of regular patch management and vulnerability remediation processes. However, due to the nature of the vulnerability, it may not be a high priority for immediate action unless specific conditions are met that increase the risk.

Recommended defensive actions

• Review and apply patches for Erlang OTP versions prior to OTP 28.3.2, OTP 27.3.4.8, and OTP 26.2.5.17.
• Update tftp to version 1.2.4 or later, 1.2.2.1 or later, and 1.1.1.1 or later as applicable.
• Review system configurations and ensure that the tftp service is not exposed unnecessarily.
• Monitor for any suspicious activity related to the tftp service.
• Perform an inventory of systems and applications using Erlang OTP to identify potential exposure.
• Verify that existing security controls and monitoring systems can detect potential exploitation attempts.
• Consider implementing additional logging and monitoring for tftp service activity.

Evidence notes

The CVE record and associated references provide evidence of the vulnerability's existence and details about the affected versions and components. However, due to the limited information available, further verification and inventory checks are recommended to determine the specific impact and required actions for individual systems and applications.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.