These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-59251 is a high-severity vulnerability in Erlang/OTP's public_key certificate path validation. A remote unauthenticated attacker can cause a denial of service by sending a crafted X.509 certificate chain during the TLS handshake. The vulnerability is due to the lack of limits in the certificate policy tree maintained by pubkey_policy_tree, which can grow exponentially with the number of policies [truncated]
CVE-2026-59250 is a high-severity buffer overflow vulnerability in the Erlang/OTP megaco flex scanner C driver. A remote unauthenticated attacker can exploit this vulnerability by sending a single text-encoded H.248/Megaco message containing an oversized property parm name, potentially leading to remote code execution or a denial-of-service crash. The vulnerability occurs in the flex scanner before any gr [truncated]
The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake, affecting OTP from OTP 23.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15. This issue allows an unauthenticated remote attacker to exhaust available memory and crash the BEAM node by sending a crafted certificate chain in a TLS or DTLS Certificate handshake message.
CVE-2026-55953 is a critical vulnerability in the Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client. The client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. This allows an on-path attacker to respond with a ServerHello selecting an anonymous key exchange suite, bypassing the verify_peer and cacerts configuration. [truncated]
CVE-2026-55737 is a Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts. An attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 can corrupt the BEAM heap pointer and crash the virtual machine. The issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15. This vulnerability has a medium severity and [truncated]
The CVE record for CVE-2026-54890 was published on 2026-07-27T16:17:41.437Z and has not been modified since then. The NVD entry is currently Received. This Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. The crash is a VM-level abort, not an Erlang-level exception. Any applica [truncated]
CVE-2026-47078 is a Relative Path Traversal vulnerability in the Erlang OTP stdlib zip module. The vulnerability allows writing files outside the intended extraction directory via a crafted zip archive. The issue affects OTP from OTP 27.1 before OTP 29.0.4, OTP 28.5.0.4, and OTP 27.3.4.15. This vulnerability is associated with program file lib/stdlib/src/zip.erl. The zip:unzip/1,2 and zip:extract/1,2 func [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T16:17:06.257Z and has not been modified since then. This Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept functi [truncated]
The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. This vulnerability allows an unauthenticated remote attacker to send a single crafted ClientHello to a TLS 1.3 server with session tickets enabled and permanently disrupt session ticket han [truncated]
A high-severity Time-of-check Time-of-use (TOCTOU) race condition vulnerability was discovered in Erlang/OTP ssl, specifically in the dtls_packet_demux module. This vulnerability allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. The attack is pre-authentication and requires the attacker to send UDP datagrams containing valid ClientHello messages from the same sourc [truncated]
The CVE-2026-54887 vulnerability is associated with a Use of Default Cryptographic Key issue in Erlang/OTP ssl (DTLS server). This allows for predictable DTLS cookie computation during the startup window, enabling source address verification bypass. The vulnerability affects OTP versions from 20.0 before 29.0.3, 28.5.0.3, and 27.3.4.14, corresponding to ssl versions 8.2 before 11.7.3, 11.6.0.3, and 11.2.1 [truncated]
CVE-2026-54886 is an infinite loop vulnerability in the Erlang OTP SSH (ssh_sftpd module). An authenticated SFTP user can render an SFTP channel permanently unresponsive by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code and any non-empty payload at or below the SFTP packet size limit. The vulnerability affects OTP from OTP 17.0 until OTP 29.0.3, 28.5.0.3, and 27.3.4.14 corresponding to ssh [truncated]
Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. This issue arises from the SSH_FXP_REALPATH handler in ssh_sftpd calling relate_file_name/3 with Canonicalize=false, unlike other SFTP operation handlers. Consequently, .. components in the requested [truncated]
A Stack-based Buffer Overflow vulnerability was discovered in Erlang OTP (erl_interface), specifically in the program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 ch [truncated]
CVE-2026-49759 is a Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv). An unauthenticated remote attacker can crash the BEAM VM by sending a crafted SCTP ERROR chunk. The vulnerability exists in the sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c, which parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] a [truncated]
CVE-2026-48860 is a HIGH severity vulnerability in OTP's ssl (inet_tls_dist module). An unauthenticated attacker can bypass the distribution-over-TLS LAN allowlist due to the inet_tls_dist:check_ip/1 function incorrectly using inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. This causes the subnet mask comparison to always succeed, allowing any holder of a CA-signed TLS certific [truncated]
CVE-2026-48859 is a medium-severity vulnerability in Erlang/OTP SSH. The vulnerability, known as an Observable Timing Discrepancy, allows an unauthenticated remote attacker to enumerate valid usernames via a timing side-channel in password authentication. The issue arises when the SSH daemon is configured with the user_passwords or password option, causing ssh_auth:check_password/3 to perform a PBKDF2-SHA [truncated]
A Server-Side Request Forgery (SSRF) vulnerability exists in the Erlang/OTP ftp (ftp_internal module). The vulnerability allows for FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the co [truncated]
CVE-2026-48855 is an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) that allows File Discovery. The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; s [truncated]
A DNS nameConstraints bypass vulnerability in Erlang/OTP's public_key library allows a subordinate Certificate Authority (CA) with restricted DNS nameConstraints to issue leaf certificates that OTP TLS clients incorrectly accept for out-of-scope hostnames. The vulnerability stems from two interacting flaws in certificate validation and hostname verification. First, the nameConstraints validation logic onl [truncated]
A certificate validation flaw in Erlang/OTP's public_key library allows attackers to forge OCSP responses using expired responder certificates, potentially bypassing certificate revocation checks in TLS clients and authentication systems.
A certificate chain validation flaw in Erlang/OTP's public_key module allows non-CA certificates to be incorrectly accepted as intermediate issuers, enabling certificate forgery attacks against TLS and mTLS endpoints.
CVE-2026-32147 is an authenticated SFTP path handling flaw in Erlang OTP's ssh_sftpd module. According to the supplied advisory data, the daemon can retain the raw user-supplied path in file handles rather than the chroot-resolved path, so a later SSH_FXP_FSETSTAT operation may apply attribute changes to the real filesystem path outside the intended root directory boundary. The issue is limited to file at [truncated]
CVE-2026-32144 is an Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module). This vulnerability allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it on [truncated]
CVE-2026-28808 is a high-severity vulnerability in Erlang OTP's inets modules. The issue arises from a path mismatch between mod_auth and mod_cgi when script_alias maps a URL prefix to a directory outside DocumentRoot. This allows unauthenticated access to CGI scripts that directory rules were meant to protect. The vulnerability affects OTP from version 17.0 until OTP 28.4.2, 27.3.4.10, and 26.2.5.19, cor [truncated]
The CVE-2026-28810 vulnerability is a Generation of Predictable Numbers or Identifiers issue in the Erlang/OTP kernel, specifically in the inet_res and inet_db modules. This vulnerability allows for DNS cache poisoning due to the use of a sequential, process-global 16-bit transaction ID for UDP queries without source port randomization. The affected versions of OTP are from 17.0 before OTP 28.4.2, OTP 27. [truncated]
CVE-2026-23943 is a denial-of-service vulnerability in Erlang/OTP's SSH transport layer. The ssh_transport code can inflate attacker-controlled data without a size limit, allowing memory exhaustion and OOM kills, especially on memory-constrained systems.
CVE-2026-21620 is a Relative Path Traversal vulnerability affecting Erlang OTP. The issue exists in the tftp_file modules of erlang/otp, erlang otp inets, and erlang otp tftp. This vulnerability allows for Relative Path Traversal. Affected versions include OTP from 17.0 before OTP 28.3.2, OTP 27.3.4.8, and OTP 26.2.5.17. The vulnerability is associated with program files lib/tftp/src/tftp_file.erl and src [truncated]
CVE-2025-32433 is a vulnerability in Erlang/OTP’s SSH server that CISA has added to the Known Exploited Vulnerabilities catalog. The issue is described as a missing authentication condition for a critical function, which makes it a high-priority defensive issue for any environment running Erlang/OTP SSH services or products that embed them. CISA’s KEV entry indicates a remediation deadline of 2025-06-30 a [truncated]