Most recent entries from all

bdu:2026-15352

EUVD-2026-364395

fkie_cve-2026-54891

The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive in pre-handshake states when the TLS endpoint acts as a server, but does not apply the same check when the endpoint acts as a client. A network-positioned attacker can send plaintext APPLICATION_DATA records to the client during the handshake. The records are buffered and, once the handshake completes successfully, delivered to the application as if they were authenticated post-handshake data. The attacker cannot observe the client's response or steer the connection, so the impact is limited to blind injection of unauthenticated bytes. The injection window is wider for TLS versions prior to TLS 1.3 than for TLS 1.3.

This vulnerability is associated with program file lib/ssl/src/tls_gen_connection.erl.

TLS 1.3 is affected starting with OTP 22.0, when TLS 1.3 support was added.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.14, from OTP 28.0 before OTP 28.5.0.3, and from OTP 29.0 before OTP 29.0.3, corresponding to ssl from 5.3.4 before 11.2.12.10, from 11.3 before 11.6.0.3, and from 11.7 before 11.7.3. Whether OTP before OTP 17.0, corresponding to ssl before 5.3.4, is affe…

msrc_CVE-2026-54891 — Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl

msrc_CVE-2026-54891

OESA-2026-3041 — erlang security update

Affected: openEuler:24.03-LTS-SP3: erlang

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fix(es):

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery.

The SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /.

The information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP from OTP 17.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssh from 3.0.1 before 6.0.1, 5.5.2.1 and 5.2.11.8.(CVE-2026-48855)

Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data.

The httpc client forwards the Authorization and P…

openSUSE-SU-2026:11559-1 — erlang-28.5.0.4-1.1 on GA media

erlang-28.5.0.4-1.1 on GA media

RHSA-2026:63160 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing erlang: Erlang OTP: Authentication bypass due to improper OCSP certificate validation erlang: Erlang OTP ssh: Information disclosure via symlink resolution in SFTP erlang: erlang-inets: erlang-ftp: Erlang/OTP ftp: Server-Side Request Forgery (SSRF) via unvalidated PASV response IP address erlang: Erlang/OTP: Authentication bypass allows arbitrary code execution via improper IP address validation erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk erlang: Erlang OTP ssh: Denial of Service via infinite loop in SFTP channel erlang: Erlang SSL: Unauthenticated data injection during TLS handshake erlang: Erlang/OTP: Denial of Service in TLS 1.3 session ticket handling erlang: Erlang/OTP: Remote denial of service via signed length overflow in TCP driver

UBUNTU-CVE-2026-54891

Affected: Ubuntu:Pro:14.04:LTS: erlang, Ubuntu:Pro:16.04:LTS: erlang, Ubuntu:Pro:18.04:LTS: erlang, Ubuntu:Pro:20.04:LTS: erlang, Ubuntu:22.04:LTS: erlang, Ubuntu:24.04:LTS: erlang, Ubuntu:25.10: erlang, Ubuntu:26.04:LTS: erlang

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive in pre-handshake states when the TLS endpoint acts as a server, but does not apply the same check when the endpoint acts as a client. A network-positioned attacker can send plaintext APPLICATION_DATA records to the client during the handshake. The records are buffered and, once the handshake completes successfully, delivered to the application as if they were authenticated post-handshake data. The attacker cannot observe the client's response or steer the connection, so the impact is limited to blind injection of unauthenticated bytes. The injection window is wider for TLS versions prior to TLS 1.3 than for TLS 1.3. This vulnerability is associated with program file lib/ssl/src/tls_gen_connection.erl. TLS 1.3 is affected starting with OTP 22.0, when TLS 1.3 support was added. This issue affects OTP from OTP 17.0 before OTP 27.3.4.14, from OTP 28.0 before OTP 28.5.0.3, and from OTP 29.0 before OTP 29.0.3, corresponding to ssl from 5.3.4 before 11.2.12.10, from 11.3 before 11.6.0.3, and from 11.7 before 11.7.3. Whether OTP before OTP 17.0, corresponding to ssl before 5.3.4, is affected…

WID-SEC-W-2026-2194 — Erlang/OTP: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Erlang/OTP ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.