PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49759 Erlang CVE debrief

CVE-2026-49759 is a Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv). An unauthenticated remote attacker can crash the BEAM VM by sending a crafted SCTP ERROR chunk. The vulnerability exists in the sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c, which parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds.

Vendor
Erlang
Product
OTP
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-07-15
Advisory published
2026-06-10
Advisory updated
2026-07-15

Who should care

Users of Erlang OTP, particularly those with exposed SCTP associations, should be aware of this vulnerability.

Technical summary

The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c does not check bounds when writing cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM.

Defensive priority

High

Recommended defensive actions

  • Update to a patched version of Erlang OTP: 27.3.4.13, 28.5.0.2, or 29.0.2.
  • Restrict access to SCTP associations.
  • Monitor for suspicious SCTP ERROR chunks.

Evidence notes

The CVE-2026-49759 vulnerability affects OTP from OTP 17.0 before 27.3.4.13, 28.5.0.2, and 29.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2, and 17.0.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49759 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49759

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49759 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49759

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-49759.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/erlang/otp/security/advisories/GHSA-6f4f-chj5-5g97

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-49759

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://www.erlang.org/doc/system/versions.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.