CVE-2026-54890 Erlang CVE debrief

Who should care

Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. This includes applications using Erlang distribution protocol on untrusted networks. Operators, platform administrators, vulnerability management teams, and security teams should review and take action based on this vulnerability.

Technical summary

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size.

Defensive priority

High priority should be given to patching affected systems, especially those exposed to untrusted ETF sources. Additional monitoring and compensating controls should be implemented for exposed systems.

Recommended defensive actions

• Patch affected OTP versions to 29.0.4, 28.5.0.4, or 27.3.4.15
• Restrict ETF decoding to trusted sources
• Implement additional monitoring for suspicious ETF decoding activity
• Review and update application code to handle ETF decoding securely
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11. The crash is a VM-level abort, not an Erlang-level exception, and cannot be intercepted by supervision trees, try/catch, or passing the [safe] option to binary_to_term/2.

Official resources