OESA-2026-2704 (CVE-2026-21620)

Vulnerability from osv_openeuler – Published: 2026-06-24 11:11 – Updated: 2026-08-06 11:11 – Source website
VLAI
Summary
erlang security update
Details

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.

Security Fix(es):

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.

This issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.(CVE-2026-21620)

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.

This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.

The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.

The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)

Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.

The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.

Two compression algorithms are affected:

  • zlib: Activates immediately after key exchange, enabling unauthenticated attacks
  • (CVE-2026-23943)
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "erlang-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-asn1-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-common_test-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-compiler-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-crypto-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-debugger-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-debuginfo-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-debugsource-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-dialyzer-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-diameter-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-edoc-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-eldap-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-erl_docgen-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-erl_interface-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-erts-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-et-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-eunit-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-examples-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-ftp-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-hipe-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-inets-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-jinterface-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-kernel-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-megaco-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-mnesia-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-observer-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-odbc-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-os_mon-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-parsetools-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-public_key-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-reltool-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-runtime_tools-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-sasl-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-snmp-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-ssh-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-ssl-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-stdlib-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-syntax_tools-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-tftp-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-tools-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-wx-23.3.4.9-10.oe2203sp4.aarch64.rpm",
          "erlang-xmerl-23.3.4.9-10.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "erlang-23.3.4.9-10.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "erlang-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-asn1-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-common_test-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-compiler-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-crypto-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-debugger-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-debuginfo-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-debugsource-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-dialyzer-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-diameter-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-edoc-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-eldap-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-erl_docgen-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-erl_interface-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-erts-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-et-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-eunit-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-examples-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-ftp-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-hipe-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-inets-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-jinterface-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-kernel-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-megaco-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-mnesia-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-observer-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-odbc-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-os_mon-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-parsetools-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-public_key-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-reltool-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-runtime_tools-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-sasl-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-snmp-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-ssh-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-ssl-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-stdlib-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-syntax_tools-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-tftp-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-tools-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-wx-23.3.4.9-10.oe2203sp4.x86_64.rpm",
          "erlang-xmerl-23.3.4.9-10.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "erlang",
        "purl": "pkg:rpm/openEuler/erlang\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "23.3.4.9-10.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Erlang is a general-purpose programming language and runtime\nenvironment. Erlang has built-in support for concurrency, distribution\nand fault tolerance. Erlang is used in several large telecommunication\nsystems from Ericsson.\r\n\r\n\nSecurity Fix(es):\n\nRelative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.\n\nThis issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.(CVE-2026-21620)\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)",
  "id": "OESA-2026-2704",
  "modified": "2026-08-06T11:11:38Z",
  "published": "2026-06-24T11:11:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2704"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21620"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23941"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23942"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23943"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "erlang security update",
  "upstream": [
    "CVE-2026-21620",
    "CVE-2026-23941",
    "CVE-2026-23942",
    "CVE-2026-23943"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.