CVE-2026-49759
CVE-2026-49759 is a high-severity vulnerability in Erlang Erlang/otp with a CVSS 3.x base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-121.
Key facts
- Severity: High (CVSS 3.x base score 8.2)
- CVSS v4: 8.8
- EPSS exploit prediction: 0% (39th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-36053
- Weakness: CWE-121
- Affected product: Erlang Erlang/otp
- Published:
- Last modified:
Description
Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk. The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exploitation to Denial of Service. A crafted SCTP ERROR chunk may also leak bits and pieces of Erlang VM memory into the received error packet observed by the Erlang process. Such data is already readable by the user running the Erlang VM, so the disclosure scope is limited. This issue affects OTP from OTP 17.0 before 27.3.4.13, 28.5.0.2 and 29.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2 and 17.0.2.
Frequently asked questions
- What is CVE-2026-49759?
- Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk. The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exploitation to Denial of Service. A crafted SCTP ERROR chunk may also leak bits and pieces of Erlang VM memory into the received error packet observed by the Erlang process. Such data is already readable by the user running the Erlang VM, so the disclosure scope is limited. This issue affects OTP from OTP 17.0 before 27.3.4.13, 28.5.0.2 and 29.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2 and 17.0.2.
- How severe is CVE-2026-49759?
- CVE-2026-49759 has a CVSS 3.x base score of 8.2, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability high.
- Is CVE-2026-49759 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-49759?
- CVE-2026-49759 primarily affects Erlang Erlang/otp. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-49759?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-49759 have an EU (EUVD) identifier?
- Yes. CVE-2026-49759 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-36053.
- When was CVE-2026-49759 published?
- CVE-2026-49759 was published on 2026-06-10 and last updated on 2026-06-30.
References
- https://cna.erlef.org/cves/CVE-2026-49759.html
- https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e
- https://github.com/erlang/otp/security/advisories/GHSA-6f4f-chj5-5g97
- https://osv.dev/vulnerability/EEF-CVE-2026-49759
- https://www.erlang.org/doc/system/versions.html#order-of-versions
- https://access.redhat.com/security/cve/CVE-2026-49759
- https://bugzilla.redhat.com/show_bug.cgi?id=2487607
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49759.json
Affected products (2)
- cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
- cpe:2.3:a:erlang:erts:*:*:*:*:*:*:*:*
More vulnerabilities in Erlang Erlang/otp
- CVE-2025-32433 — Critical (CVSS 10.0): Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and…
- CVE-2026-28808 — Critical (CVSS 9.8): Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts…
- CVE-2022-37026 — Critical (CVSS 9.8): In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass…
- CVE-2016-10253 — Critical (CVSS 9.8): An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap…
- CVE-2026-23941 — Critical (CVSS 9.4): Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd…
- CVE-2026-42790 — High (CVSS 8.1): Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a…
All CVEs affecting Erlang Erlang/otp →
Other CWE-121 (Stack-based Buffer Overflow) vulnerabilities
- CVE-2026-12848 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
- CVE-2026-12847 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
- CVE-2026-12846 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
- CVE-2026-12485 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
- CVE-2026-37541 — Critical (CVSS 10.0): Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length…
- CVE-2026-42996 — Critical (CVSS 10.0): JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of…
Browse all CWE-121 (Stack-based Buffer Overflow) vulnerabilities →