{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48855",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T16:22:16.684743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T16:22:24.746Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "ssh_sftpd"
          ],
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "lib/ssh/src/ssh_sftpd.erl"
          ],
          "programRoutines": [
            {
              "name": "ssh_sftpd:handle_op/4"
            }
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "27.3.4.13",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "29.0.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "17.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "ssh_sftpd"
          ],
          "packageName": "ssh",
          "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "src/ssh_sftpd.erl"
          ],
          "programRoutines": [
            {
              "name": "ssh_sftpd:handle_op/4"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.2.11.8",
                  "status": "unaffected"
                },
                {
                  "at": "5.5.2.1",
                  "status": "unaffected"
                },
                {
                  "at": "6.0.1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "3.0.1",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "ssh_sftpd"
          ],
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "lib/ssh/src/ssh_sftpd.erl"
          ],
          "programRoutines": [
            {
              "name": "ssh_sftpd:handle_op/4"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "8f4224a0d2676b0653d2c71a889a956e8c2c62d6",
              "status": "affected",
              "version": "08225797f7ef943d0c82a1d9dd6650d94ca2580d",
              "versionType": "git"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8f4224a0d2676b0653d2c71a889a956e8c2c62d6",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe SFTP subsystem must be enabled on the SSH server and the \u003ccode\u003eroot\u003c/code\u003e option must be configured in the \u003ccode\u003essh_sftpd:subsystem_spec/1\u003c/code\u003e call. Deployments without the \u003ccode\u003eroot\u003c/code\u003e option are not affected.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The SFTP subsystem must be enabled on the SSH server and the `root` option must be configured in the `ssh_sftpd:subsystem_spec/1` call. Deployments without the `root` option are not affected."
            }
          ],
          "value": "The SFTP subsystem must be enabled on the SSH server and the root option must be configured in the ssh_sftpd:subsystem_spec/1 call. Deployments without the root option are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.3.4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.5.0.2",
                  "versionStartIncluding": "28.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.0.2",
                  "versionStartIncluding": "29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Micha\u0142 W\u0105sowski"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Jakub Witczak"
        }
      ],
      "datePublic": "2026-06-10T14:35:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (\u003ccode\u003essh_sftpd\u003c/code\u003e module) allows File Discovery.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eSSH_FXP_READLINK\u003c/code\u003e handler in \u003ccode\u003essh_sftpd\u003c/code\u003e sends the raw result of \u003ccode\u003efile:read_link/2\u003c/code\u003e to the client without calling \u003ccode\u003echroot_filename/2\u003c/code\u003e to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to \u003ccode\u003e/\u003c/code\u003e; \u003ccode\u003essh_sftpd\u003c/code\u003e resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via \u003ccode\u003eSSH_FXP_READLINK\u003c/code\u003e returns that absolute path, for example \u003ccode\u003e/data/sftp\u003c/code\u003e, instead of the chrooted value \u003ccode\u003e/\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/ssh/src/ssh_sftpd.erl\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;17.0 before OTP\u0026nbsp;27.3.4.13, OTP\u0026nbsp;28.5.0.2, and OTP\u0026nbsp;29.0.2, corresponding to ssh from 3.0.1 before 5.2.11.8, 5.5.2.1, and 6.0.1. Whether OTP before OTP\u0026nbsp;17.0, corresponding to ssh before 3.0.1, is affected is unknown.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (`ssh_sftpd` module) allows File Discovery.\n\nThe `SSH_FXP_READLINK` handler in `ssh_sftpd` sends the raw result of `file:read_link/2` to the client without calling `chroot_filename/2` to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to `/`; `ssh_sftpd` resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via `SSH_FXP_READLINK` returns that absolute path, for example `/data/sftp`, instead of the chrooted value `/`.\n\nThe information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_sftpd.erl`.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to ssh from 3.0.1 before 5.2.11.8, 5.5.2.1, and 6.0.1. Whether OTP before OTP\u00a017.0, corresponding to ssh before 3.0.1, is affected is unknown."
            }
          ],
          "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery.\n\nThe SSH_FXP_READLINK handler in ssh_sftpd sends the raw result of file:read_link/2 to the client without calling chroot_filename/2 to strip the backend root prefix. An authenticated SFTP client can create a symlink inside the chroot pointing to /; ssh_sftpd resolves the target to the absolute backend root and stores it on disk. Reading the symlink back via SSH_FXP_READLINK returns that absolute path, for example /data/sftp, instead of the chrooted value /.\n\nThe information disclosed is the absolute filesystem path of the SFTP root directory and of any symlink targets within it. No file contents, credentials, or access to paths outside the root directory are obtainable through this issue alone.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to ssh from 3.0.1 before 5.2.11.8, 5.5.2.1, and 6.0.1. Whether OTP before OTP\u00a017.0, corresponding to ssh before 3.0.1, is affected is unknown."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-116",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-116 Excavation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T20:35:33.970Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-pv7g-pjrq-x2fh"
        },
        {
          "name": "EEF CNA record for CVE-2026-48855",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48855.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-48855",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48855"
        },
        {
          "name": "Erlang/OTP version ordering",
          "tags": [
            "x_version-scheme"
          ],
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        },
        {
          "name": "Introducing commit 0822579 in erlang/otp",
          "tags": [
            "related"
          ],
          "url": "https://github.com/erlang/otp/commit/08225797f7ef943d0c82a1d9dd6650d94ca2580d"
        },
        {
          "name": "Fix commit 8f4224a in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/8f4224a0d2676b0653d2c71a889a956e8c2c62d6"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\n\u003cli\u003eUse OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment, eliminating reliance on the application-level \u003ccode\u003eroot\u003c/code\u003e option.\u003c/li\u003e\n\u003cli\u003eEnsure that the SFTP server port is not reachable from untrusted machines.\u003c/li\u003e\n\u003cli\u003eEnsure that no sensitive information (usernames, project names, mount topology) is inferrable from the absolute path of the configured root directory.\u003c/li\u003e\n\u003c/ul\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment, eliminating reliance on the application-level `root` option.\n* Ensure that the SFTP server port is not reachable from untrusted machines.\n* Ensure that no sensitive information (usernames, project names, mount topology) is inferrable from the absolute path of the configured root directory."
            }
          ],
          "value": "* Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment, eliminating reliance on the application-level root option.\n* Ensure that the SFTP server port is not reachable from untrusted machines.\n* Ensure that no sensitive information (usernames, project names, mount topology) is inferrable from the absolute path of the configured root directory."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48855",
    "datePublished": "2026-06-10T14:35:49.683Z",
    "dateReserved": "2026-05-25T20:44:10.697Z",
    "dateUpdated": "2026-09-24T20:35:33.970Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T16:23:52.053802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T16:24:02.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "httpc_response"
          ],
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "lib/inets/src/http_client/httpc_response.erl"
          ],
          "programRoutines": [
            {
              "name": "httpc_response:redirect/2"
            }
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "27.3.4.19",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.8",
                  "status": "unaffected"
                },
                {
                  "at": "29.1.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "17.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "httpc_response"
          ],
          "packageName": "inets",
          "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "src/http_client/httpc_response.erl"
          ],
          "programRoutines": [
            {
              "name": "httpc_response:redirect/2"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "9.3.2.8",
                  "status": "unaffected"
                },
                {
                  "at": "9.6.2.4",
                  "status": "unaffected"
                },
                {
                  "at": "9.8.1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "5.10",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "httpc_response"
          ],
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "lib/inets/src/http_client/httpc_response.erl"
          ],
          "programRoutines": [
            {
              "name": "httpc_response:redirect/2"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "f78fae9294886f95545a2212671282eda230def1",
              "status": "affected",
              "version": "84adefa331c4159d432d22840663c38f155cd4c1",
              "versionType": "git"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "f78fae9294886f95545a2212671282eda230def1",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.3.4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.5.0.8",
                  "versionStartIncluding": "28.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.1.2",
                  "versionStartIncluding": "29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Konrad Pietrzak"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ingela Andin"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Konrad Pietrzak"
        }
      ],
      "datePublic": "2026-06-10T14:41:51.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSensitive Data Exposure vulnerability in Erlang OTP inets (\u003ccode\u003ehttpc_response\u003c/code\u003e module) allows Retrieve Embedded Sensitive Data.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003ehttpc\u003c/code\u003e client forwards the \u003ccode\u003eAuthorization\u003c/code\u003e and \u003ccode\u003eProxy-Authorization\u003c/code\u003e request headers to redirect targets without checking whether the redirect crosses an origin boundary. \u003ccode\u003ehttpc_response:redirect/2\u003c/code\u003e constructs the redirected request by updating only the \u003ccode\u003ehost\u003c/code\u003e field of the header record; all other fields (including \u003ccode\u003eauthorization\u003c/code\u003e and \u003ccode\u003eproxy_authorization\u003c/code\u003e) are copied verbatim. The redirect target host is never compared against the original host.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eautoredirect\u003c/code\u003e defaults to \u003ccode\u003etrue\u003c/code\u003e, so this affects all \u003ccode\u003ehttpc\u003c/code\u003e callers that do not explicitly disable automatic redirects.\u003c/p\u003e\n\u003cp\u003eAn attacker who controls a server that the victim contacts via \u003ccode\u003ehttpc\u003c/code\u003e can issue a cross-origin 3xx redirect to a server they also control. The \u003ccode\u003eAuthorization\u003c/code\u003e header (including Basic credentials derived from URL userinfo via \u003ccode\u003ehttpc_request:handle_user_info/2\u003c/code\u003e) is forwarded to the redirect target, allowing credential theft. The same applies to the \u003ccode\u003eProxy-Authorization\u003c/code\u003e header.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/inets/src/http_client/httpc_response.erl\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;17.0 before OTP\u0026nbsp;27.3.4.19, OTP\u0026nbsp;28.5.0.8, and OTP\u0026nbsp;29.1.2, corresponding to inets from 5.10 before 9.3.2.8, 9.6.2.4, and 9.8.1. Whether OTP before OTP\u0026nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Sensitive Data Exposure vulnerability in Erlang OTP inets (`httpc_response` module) allows Retrieve Embedded Sensitive Data.\n\nThe `httpc` client forwards the `Authorization` and `Proxy-Authorization` request headers to redirect targets without checking whether the redirect crosses an origin boundary. `httpc_response:redirect/2` constructs the redirected request by updating only the `host` field of the header record; all other fields (including `authorization` and `proxy_authorization`) are copied verbatim. The redirect target host is never compared against the original host.\n\n`autoredirect` defaults to `true`, so this affects all `httpc` callers that do not explicitly disable automatic redirects.\n\nAn attacker who controls a server that the victim contacts via `httpc` can issue a cross-origin 3xx redirect to a server they also control. The `Authorization` header (including Basic credentials derived from URL userinfo via `httpc_request:handle_user_info/2`) is forwarded to the redirect target, allowing credential theft. The same applies to the `Proxy-Authorization` header.\n\nThis vulnerability is associated with program files `lib/inets/src/http_client/httpc_response.erl`.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to inets from 5.10 before 9.3.2.8, 9.6.2.4, and 9.8.1. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
            }
          ],
          "value": "Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data.\n\nThe httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header record; all other fields (including authorization and proxy_authorization) are copied verbatim. The redirect target host is never compared against the original host.\n\nautoredirect defaults to true, so this affects all httpc callers that do not explicitly disable automatic redirects.\n\nAn attacker who controls a server that the victim contacts via httpc can issue a cross-origin 3xx redirect to a server they also control. The Authorization header (including Basic credentials derived from URL userinfo via httpc_request:handle_user_info/2) is forwarded to the redirect target, allowing credential theft. The same applies to the Proxy-Authorization header.\n\nThis vulnerability is associated with program files lib/inets/src/http_client/httpc_response.erl.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to inets from 5.10 before 9.3.2.8, 9.6.2.4, and 9.8.1. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T10:50:06.903Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "GitHub Advisory",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-m75x-4vwg-ggjh"
        },
        {
          "name": "EEF CNA record for CVE-2026-48856",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48856.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-48856",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48856"
        },
        {
          "name": "Erlang/OTP version ordering",
          "tags": [
            "x_version-scheme"
          ],
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        },
        {
          "name": "Fix commit f78fae9 in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/f78fae9294886f95545a2212671282eda230def1"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "httpc leaks Authorization header to cross-origin redirect targets",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\n\u003cli\u003eSet \u003ccode\u003e{autoredirect, false}\u003c/code\u003e in the \u003ccode\u003ehttpc:request/4\u003c/code\u003e options and handle redirects manually, stripping the \u003ccode\u003eAuthorization\u003c/code\u003e header when the redirect crosses an origin boundary.\u003c/li\u003e\n\u003cli\u003eEnsure that \u003ccode\u003ehttpc\u003c/code\u003e is only used to contact trusted servers that will not issue cross-origin redirects.\u003c/li\u003e\n\u003c/ul\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "* Set `{autoredirect, false}` in the `httpc:request/4` options and handle redirects manually, stripping the `Authorization` header when the redirect crosses an origin boundary.\n* Ensure that `httpc` is only used to contact trusted servers that will not issue cross-origin redirects."
            }
          ],
          "value": "* Set {autoredirect, false} in the httpc:request/4 options and handle redirects manually, stripping the Authorization header when the redirect crosses an origin boundary.\n* Ensure that httpc is only used to contact trusted servers that will not issue cross-origin redirects."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48856",
    "datePublished": "2026-06-10T14:41:51.616Z",
    "dateReserved": "2026-05-25T20:44:10.697Z",
    "dateUpdated": "2026-10-15T10:50:06.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T16:20:57.662713Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T16:21:08.893Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "ftp_internal"
          ],
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "lib/inets/src/ftp/ftp_internal.erl",
            "lib/ftp/src/ftp_internal.erl"
          ],
          "programRoutines": [
            {
              "name": "ftp_internal:handle_ctrl_result/2"
            }
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "27.3.4.13",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "29.0.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "17.4",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "ftp_internal"
          ],
          "packageName": "inets",
          "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "src/ftp/ftp_internal.erl"
          ],
          "programRoutines": [
            {
              "name": "ftp_internal:handle_ctrl_result/2"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "7.0",
              "status": "affected",
              "version": "5.10.4",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "ftp_internal"
          ],
          "packageName": "ftp",
          "packageURL": "pkg:otp/ftp?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "src/ftp_internal.erl"
          ],
          "programRoutines": [
            {
              "name": "ftp_internal:handle_ctrl_result/2"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.2.3.1",
                  "status": "unaffected"
                },
                {
                  "at": "1.2.4.1",
                  "status": "unaffected"
                },
                {
                  "at": "1.2.6",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "1.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "ftp_internal"
          ],
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "lib/inets/src/ftp/ftp_internal.erl",
            "lib/ftp/src/ftp_internal.erl"
          ],
          "programRoutines": [
            {
              "name": "ftp_internal:handle_ctrl_result/2"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "521bcfa24407ee8cb5614823cf905c37ea3aa605",
                  "status": "unaffected"
                },
                {
                  "at": "2691a806231ffd0490a8a9e20500dec0c7e73727",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "be95772ee1fcfe71045ef070130bea7a910b81e3",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vulnerable path is active under the default configuration: \u003ccode\u003emode=passive\u003c/code\u003e, \u003ccode\u003eipfamily=inet\u003c/code\u003e, and \u003ccode\u003eftp_extension=false\u003c/code\u003e are all defaults for \u003ccode\u003eftp:open/2\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The vulnerable path is active under the default configuration: `mode=passive`, `ipfamily=inet`, and `ftp_extension=false` are all defaults for `ftp:open/2`."
            }
          ],
          "value": "The vulnerable path is active under the default configuration: mode=passive, ipfamily=inet, and ftp_extension=false are all defaults for ftp:open/2."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.3.4.13",
                  "versionStartIncluding": "17.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.5.0.2",
                  "versionStartIncluding": "28.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.0.2",
                  "versionStartIncluding": "29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ingela Anderton Andin"
        }
      ],
      "datePublic": "2026-06-10T14:35:45.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eServer-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eftp_internal:handle_ctrl_result/2\u003c/code\u003e PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server\u0027s 227 response and passes it directly to \u003ccode\u003egen_tcp:connect/4\u003c/code\u003e without validating it against the control connection peer address. The adjacent EPSV handlers correctly call \u003ccode\u003epeername(CSock)\u003c/code\u003e to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client\u0027s data connection to an arbitrary internal host and port. On read operations (\u003ccode\u003eftp:ls/1,2\u003c/code\u003e, \u003ccode\u003eftp:nlist/1,2\u003c/code\u003e, \u003ccode\u003eftp:recv/2,3\u003c/code\u003e), data from the redirected target is returned to the caller. On write operations (\u003ccode\u003eftp:send/2,3\u003c/code\u003e, \u003ccode\u003eftp:append/2,3\u003c/code\u003e), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.\u003c/p\u003e\n\u003cp\u003eThe vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eftp\u003c/code\u003e application is deprecated and scheduled for removal in OTP-30.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/inets/src/ftp/ftp_internal.erl\u003c/code\u003e (inets 5.10.4 through 6.5, OTP\u0026nbsp;17.4 through 20.3) and \u003ccode\u003elib/ftp/src/ftp_internal.erl\u003c/code\u003e (ftp 1.0 and later, OTP\u0026nbsp;21.0 and later).\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;17.4 before OTP\u0026nbsp;27.3.4.13, OTP\u0026nbsp;28.5.0.2, and OTP\u0026nbsp;29.0.2, corresponding to inets from 5.10.4 before 7.0, and ftp from 1.0 before 1.2.3.1, 1.2.4.1, and 1.2.6.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.\n\nThe `ftp_internal:handle_ctrl_result/2` PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server\u0027s 227 response and passes it directly to `gen_tcp:connect/4` without validating it against the control connection peer address. The adjacent EPSV handlers correctly call `peername(CSock)` to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client\u0027s data connection to an arbitrary internal host and port. On read operations (`ftp:ls/1,2`, `ftp:nlist/1,2`, `ftp:recv/2,3`), data from the redirected target is returned to the caller. On write operations (`ftp:send/2,3`, `ftp:append/2,3`), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.\n\nThe vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.\n\nThe `ftp` application is deprecated and scheduled for removal in OTP-30.\n\nThis vulnerability is associated with program files `lib/inets/src/ftp/ftp_internal.erl` (inets 5.10.4 through 6.5, OTP\u00a017.4 through 20.3) and `lib/ftp/src/ftp_internal.erl` (ftp 1.0 and later, OTP\u00a021.0 and later).\n\nThis issue affects OTP from OTP\u00a017.4 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to inets from 5.10.4 before 7.0, and ftp from 1.0 before 1.2.3.1, 1.2.4.1, and 1.2.6."
            }
          ],
          "value": "Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.\n\nThe ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server\u0027s 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client\u0027s data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.\n\nThe vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.\n\nThe ftp application is deprecated and scheduled for removal in OTP-30.\n\nThis vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP\u00a017.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP\u00a021.0 and later).\n\nThis issue affects OTP from OTP\u00a017.4 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to inets from 5.10.4 before 7.0, and ftp from 1.0 before 1.2.3.1, 1.2.4.1, and 1.2.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T19:05:09.624Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "FTP Client PASV Response IP not Validated Against Control Peer, Enabling SSRF and FTP Bounce Attacks",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-24cv-hwgr-37fq"
        },
        {
          "name": "EEF CNA record for CVE-2026-48858",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48858.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-48858",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48858"
        },
        {
          "name": "Erlang/OTP version ordering",
          "tags": [
            "x_version-scheme"
          ],
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        },
        {
          "name": "Introducing commit be95772 in erlang/otp",
          "tags": [
            "related"
          ],
          "url": "https://github.com/erlang/otp/commit/be95772ee1fcfe71045ef070130bea7a910b81e3"
        },
        {
          "name": "Fix commit 521bcfa in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/521bcfa24407ee8cb5614823cf905c37ea3aa605"
        },
        {
          "name": "Fix commit 2691a80 in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/2691a806231ffd0490a8a9e20500dec0c7e73727"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePass \u003ccode\u003e{ftp_extension, true}\u003c/code\u003e to \u003ccode\u003eftp:open/2\u003c/code\u003e to use EPSV instead of PASV. Alternatively, pass \u003ccode\u003e{mode, active}\u003c/code\u003e to use active mode, or pass \u003ccode\u003e{ipfamily, inet6}\u003c/code\u003e to force IPv6, both of which bypass the vulnerable PASV path.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Pass `{ftp_extension, true}` to `ftp:open/2` to use EPSV instead of PASV. Alternatively, pass `{mode, active}` to use active mode, or pass `{ipfamily, inet6}` to force IPv6, both of which bypass the vulnerable PASV path."
            }
          ],
          "value": "Pass {ftp_extension, true} to ftp:open/2 to use EPSV instead of PASV. Alternatively, pass {mode, active} to use active mode, or pass {ipfamily, inet6} to force IPv6, both of which bypass the vulnerable PASV path."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48858",
    "datePublished": "2026-06-10T14:35:45.466Z",
    "dateReserved": "2026-05-25T20:44:10.697Z",
    "dateUpdated": "2026-11-11T19:05:09.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T16:19:16.914933Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T16:19:43.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "ssh_auth",
            "ssh_options"
          ],
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "lib/ssh/src/ssh_auth.erl",
            "lib/ssh/src/ssh_options.erl"
          ],
          "programRoutines": [
            {
              "name": "ssh_auth:check_password/3"
            },
            {
              "name": "ssh_options:get_password_option/2"
            }
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "29.0.2",
              "status": "affected",
              "version": "29.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "ssh_auth",
            "ssh_options"
          ],
          "packageName": "ssh",
          "packageURL": "pkg:otp/ssh?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "src/ssh_auth.erl",
            "src/ssh_options.erl"
          ],
          "programRoutines": [
            {
              "name": "ssh_auth:check_password/3"
            },
            {
              "name": "ssh_options:get_password_option/2"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "6.0.1",
              "status": "affected",
              "version": "6.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "ssh_auth",
            "ssh_options"
          ],
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "lib/ssh/src/ssh_auth.erl",
            "lib/ssh/src/ssh_options.erl"
          ],
          "programRoutines": [
            {
              "name": "ssh_auth:check_password/3"
            },
            {
              "name": "ssh_options:get_password_option/2"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "c342092ef4b369bb409d5b71ac8fd83bab74aedf",
              "status": "affected",
              "version": "032d1bc9491a3975c68faf9bc7776115d6ae3005",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe SSH daemon must be configured with the \u003ccode\u003euser_passwords\u003c/code\u003e or \u003ccode\u003epassword\u003c/code\u003e option for password authentication. Systems using the \u003ccode\u003epwdfun\u003c/code\u003e option instead are not affected.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The SSH daemon must be configured with the `user_passwords` or `password` option for password authentication. Systems using the `pwdfun` option instead are not affected."
            }
          ],
          "value": "The SSH daemon must be configured with the user_passwords or password option for password authentication. Systems using the pwdfun option instead are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.0.2",
                  "versionStartIncluding": "29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhang Delong"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Witczak"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Ingela Anderton Andin"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Micha\u0142 W\u0105sowski"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eObservable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.\u003c/p\u003e\n\u003cp\u003eWhen the SSH daemon is configured with the \u003ccode\u003euser_passwords\u003c/code\u003e or \u003ccode\u003epassword\u003c/code\u003e option, \u003ccode\u003essh_auth:check_password/3\u003c/code\u003e performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the \u003ccode\u003essh_options:get_password_option/2\u003c/code\u003e path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003euser_passwords\u003c/code\u003e and \u003ccode\u003epassword\u003c/code\u003e options are documented as intended for test purposes; the recommended alternative is \u003ccode\u003epwdfun\u003c/code\u003e, which is not affected by this vulnerability.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/ssh/src/ssh_auth.erl\u003c/code\u003e and \u003ccode\u003elib/ssh/src/ssh_options.erl\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;29.0 before OTP\u0026nbsp;29.0.2, corresponding to ssh from 6.0 before 6.0.1.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.\n\nWhen the SSH daemon is configured with the `user_passwords` or `password` option, `ssh_auth:check_password/3` performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the `ssh_options:get_password_option/2` path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames.\n\nThe `user_passwords` and `password` options are documented as intended for test purposes; the recommended alternative is `pwdfun`, which is not affected by this vulnerability.\n\nThis vulnerability is associated with program files `lib/ssh/src/ssh_auth.erl` and `lib/ssh/src/ssh_options.erl`.\n\nThis issue affects OTP from OTP\u00a029.0 before OTP\u00a029.0.2, corresponding to ssh from 6.0 before 6.0.1."
            }
          ],
          "value": "Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.\n\nWhen the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh_options:get_password_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames.\n\nThe user_passwords and password options are documented as intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_auth.erl and lib/ssh/src/ssh_options.erl.\n\nThis issue affects OTP from OTP\u00a029.0 before OTP\u00a029.0.2, corresponding to ssh from 6.0 before 6.0.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-116",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-116 Excavation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208 Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T13:57:17.599Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-3w6p-vwhf-wvp4"
        },
        {
          "name": "EEF CNA record for CVE-2026-48859",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48859.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-48859",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48859"
        },
        {
          "name": "Erlang/OTP version ordering",
          "tags": [
            "x_version-scheme"
          ],
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        },
        {
          "name": "Introducing commit 032d1bc in erlang/otp",
          "tags": [
            "related"
          ],
          "url": "https://github.com/erlang/otp/commit/032d1bc9491a3975c68faf9bc7776115d6ae3005"
        },
        {
          "name": "Fix commit c342092 in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/c342092ef4b369bb409d5b71ac8fd83bab74aedf"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\n\u003cli\u003eUse the \u003ccode\u003epwdfun\u003c/code\u003e option instead of \u003ccode\u003euser_passwords\u003c/code\u003e for password authentication. The \u003ccode\u003epwdfun\u003c/code\u003e callback gives full control over timing behavior and is not affected by this vulnerability. Implementations should take care to execute in approximately constant time regardless of username validity.\u003c/li\u003e\n\u003cli\u003eRestrict SSH port access to trusted networks only via firewall rules, reducing the set of potential attackers who can perform timing measurements.\u003c/li\u003e\n\u003c/ul\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "* Use the `pwdfun` option instead of `user_passwords` for password authentication. The `pwdfun` callback gives full control over timing behavior and is not affected by this vulnerability. Implementations should take care to execute in approximately constant time regardless of username validity.\n* Restrict SSH port access to trusted networks only via firewall rules, reducing the set of potential attackers who can perform timing measurements."
            }
          ],
          "value": "* Use the pwdfun option instead of user_passwords for password authentication. The pwdfun callback gives full control over timing behavior and is not affected by this vulnerability. Implementations should take care to execute in approximately constant time regardless of username validity.\n* Restrict SSH port access to trusted networks only via firewall rules, reducing the set of potential attackers who can perform timing measurements."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48859",
    "datePublished": "2026-06-10T14:35:43.553Z",
    "dateReserved": "2026-05-25T20:44:10.697Z",
    "dateUpdated": "2026-11-11T13:57:17.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T16:23:08.922807Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T16:23:31.951Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "inet_tls_dist"
          ],
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "lib/ssl/src/inet_tls_dist.erl"
          ],
          "programRoutines": [
            {
              "name": "inet_tls_dist:check_ip/1"
            }
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "27.3.4.13",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "29.0.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "26.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "inet_tls_dist"
          ],
          "packageName": "ssl",
          "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "src/inet_tls_dist.erl"
          ],
          "programRoutines": [
            {
              "name": "inet_tls_dist:check_ip/1"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "11.2.12.9",
                  "status": "unaffected"
                },
                {
                  "at": "11.6.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "11.7.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "11.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "inet_tls_dist"
          ],
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "lib/ssl/src/inet_tls_dist.erl"
          ],
          "programRoutines": [
            {
              "name": "inet_tls_dist:check_ip/1"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "0209a6df65d605552b378273027b3968b35f26b4",
              "status": "affected",
              "version": "7a08c5507862a7011568506d0c17b1fdef30bee4",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Erlang distribution must be configured to use TLS (\u003ccode\u003einet_tls_dist\u003c/code\u003e) with the \u003ccode\u003echeck_ip\u003c/code\u003e option enabled. The default Erlang distribution configuration does not use TLS and is not affected.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The Erlang distribution must be configured to use TLS (`inet_tls_dist`) with the `check_ip` option enabled. The default Erlang distribution configuration does not use TLS and is not affected."
            }
          ],
          "value": "The Erlang distribution must be configured to use TLS (inet_tls_dist) with the check_ip option enabled. The default Erlang distribution configuration does not use TLS and is not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.3.4.13",
                  "versionStartIncluding": "26.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.5.0.2",
                  "versionStartIncluding": "28.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.0.2",
                  "versionStartIncluding": "29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lukas Backstr\u00f6m"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ingela Anderton Andin"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Raimo Niskanen"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Jakub Witczak"
        }
      ],
      "datePublic": "2026-06-10T14:35:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003einet_tls_dist:check_ip/1\u003c/code\u003e function, which enforces a LAN allowlist for Erlang distribution over TLS, calls \u003ccode\u003einet:sockname/1\u003c/code\u003e instead of \u003ccode\u003einet:peername/1\u003c/code\u003e to obtain the peer\u0027s IP address. Because \u003ccode\u003einet:sockname/1\u003c/code\u003e returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including \u003ccode\u003erpc:call/4\u003c/code\u003e and \u003ccode\u003ecode:load_binary/3\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program file \u003ccode\u003elib/ssl/src/inet_tls_dist.erl\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;26.0 before OTP\u0026nbsp;27.3.4.13, OTP\u0026nbsp;28.5.0.2, and OTP\u0026nbsp;29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\n\nThe `inet_tls_dist:check_ip/1` function, which enforces a LAN allowlist for Erlang distribution over TLS, calls `inet:sockname/1` instead of `inet:peername/1` to obtain the peer\u0027s IP address. Because `inet:sockname/1` returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including `rpc:call/4` and `code:load_binary/3`.\n\nThis vulnerability is associated with program file `lib/ssl/src/inet_tls_dist.erl`.\n\nThis issue affects OTP from OTP\u00a026.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2."
            }
          ],
          "value": "Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist.\n\nThe inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer\u0027s IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3.\n\nThis vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl.\n\nThis issue affects OTP from OTP\u00a026.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        },
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1025",
              "description": "CWE-1025 Comparison Using Wrong Factors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T20:39:54.903Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-gp7x-mfv6-52cv"
        },
        {
          "name": "EEF CNA record for CVE-2026-48860",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48860.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-48860",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48860"
        },
        {
          "name": "Erlang/OTP version ordering",
          "tags": [
            "x_version-scheme"
          ],
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        },
        {
          "name": "Introducing commit 7a08c55 in erlang/otp",
          "tags": [
            "related"
          ],
          "url": "https://github.com/erlang/otp/commit/7a08c5507862a7011568506d0c17b1fdef30bee4"
        },
        {
          "name": "Fix commit 0209a6d in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/0209a6df65d605552b378273027b3968b35f26b4"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImplement a custom \u003ccode\u003everify_fun\u003c/code\u003e SSL option that correctly checks the peer IP address using \u003ccode\u003einet:peername/1\u003c/code\u003e on the socket.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Implement a custom `verify_fun` SSL option that correctly checks the peer IP address using `inet:peername/1` on the socket."
            }
          ],
          "value": "Implement a custom verify_fun SSL option that correctly checks the peer IP address using inet:peername/1 on the socket."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48860",
    "datePublished": "2026-06-10T14:35:49.987Z",
    "dateReserved": "2026-05-25T20:44:10.697Z",
    "dateUpdated": "2026-09-24T20:39:54.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T16:18:27.945916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T16:18:43.800Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "erlang",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "erlang",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "erlang",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-10T14:35:38.838Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Erlang OTP (Open Telecom Platform) erts, specifically within the `inet_drv` component. An unauthenticated remote attacker can exploit a stack-based buffer overflow vulnerability by sending a specially crafted Stream Control Transmission Protocol (SCTP) ERROR chunk. This can lead to a Denial of Service (DoS) by crashing the BEAM virtual machine. Additionally, this flaw may result in limited information disclosure by leaking small portions of Erlang VM memory."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T12:04:38.340Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-49759"
          },
          {
            "name": "RHBZ#2487607",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487607"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49759.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-10T16:01:51.030Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-10T14:35:38.838Z",
            "value": "Made public."
          }
        ],
        "title": "erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "inet_drv"
          ],
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "erts/emulator/drivers/common/inet_drv.c"
          ],
          "programRoutines": [
            {
              "name": "sctp_parse_error_chunk"
            }
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "27.3.4.13",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "29.0.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "17.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "inet_drv"
          ],
          "packageName": "erts",
          "packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "emulator/drivers/common/inet_drv.c"
          ],
          "programRoutines": [
            {
              "name": "sctp_parse_error_chunk"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "15.2.7.9",
                  "status": "unaffected"
                },
                {
                  "at": "16.4.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "17.0.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "6.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "inet_drv"
          ],
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "erts/emulator/drivers/common/inet_drv.c"
          ],
          "programRoutines": [
            {
              "name": "sctp_parse_error_chunk"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "3983d495284331c121f600a80bac9fcf4e16381e",
              "status": "affected",
              "version": "84adefa331c4159d432d22840663c38f155cd4c1",
              "versionType": "git"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3983d495284331c121f600a80bac9fcf4e16381e",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSCTP support must be compiled into OTP. A listening SCTP socket must be opened via \u003ccode\u003egen_sctp\u003c/code\u003e with the default \u003ccode\u003einet\u003c/code\u003e backend and must be reachable from the attacker\u0027s network. Windows builds are unaffected as SCTP is not supported on Windows.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "SCTP support must be compiled into OTP. A listening SCTP socket must be opened via `gen_sctp` with the default `inet` backend and must be reachable from the attacker\u0027s network. Windows builds are unaffected as SCTP is not supported on Windows."
            }
          ],
          "value": "SCTP support must be compiled into OTP. A listening SCTP socket must be opened via gen_sctp with the default inet backend and must be reachable from the attacker\u0027s network. Windows builds are unaffected as SCTP is not supported on Windows."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.3.4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.5.0.2",
                  "versionStartIncluding": "28.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.0.2",
                  "versionStartIncluding": "29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhang Delong"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Raimo Niskanen"
        }
      ],
      "datePublic": "2026-06-10T14:35:38.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStack-based Buffer Overflow vulnerability in Erlang OTP \u003ccode\u003eerts\u003c/code\u003e (\u003ccode\u003einet_drv\u003c/code\u003e) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003esctp_parse_error_chunk\u003c/code\u003e function in \u003ccode\u003eerts/emulator/drivers/common/inet_drv.c\u003c/code\u003e parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated \u003ccode\u003eErlDrvTermData spec[]\u003c/code\u003e array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exploitation to Denial of Service.\u003c/p\u003e\n\u003cp\u003eA crafted SCTP ERROR chunk may also leak bits and pieces of Erlang VM memory into the received error packet observed by the Erlang process. Such data is already readable by the user running the Erlang VM, so the disclosure scope is limited.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;17.0 before OTP\u0026nbsp;27.3.4.13, OTP\u0026nbsp;28.5.0.2, and OTP\u0026nbsp;29.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2, and 17.0.2. Whether OTP before OTP\u0026nbsp;17.0, corresponding to erts before 6.0, is affected is unknown.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP `erts` (`inet_drv`) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk.\n\nThe `sctp_parse_error_chunk` function in `erts/emulator/drivers/common/inet_drv.c` parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated `ErlDrvTermData spec[]` array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exploitation to Denial of Service.\n\nA crafted SCTP ERROR chunk may also leak bits and pieces of Erlang VM memory into the received error packet observed by the Erlang process. Such data is already readable by the user running the Erlang VM, so the disclosure scope is limited.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2, and 17.0.2. Whether OTP before OTP\u00a017.0, corresponding to erts before 6.0, is affected is unknown."
            }
          ],
          "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk.\n\nThe sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exploitation to Denial of Service.\n\nA crafted SCTP ERROR chunk may also leak bits and pieces of Erlang VM memory into the received error packet observed by the Erlang process. Such data is already readable by the user running the Erlang VM, so the disclosure scope is limited.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2, and 17.0.2. Whether OTP before OTP\u00a017.0, corresponding to erts before 6.0, is affected is unknown."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T20:41:04.351Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-6f4f-chj5-5g97"
        },
        {
          "name": "EEF CNA record for CVE-2026-49759",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-49759.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-49759",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49759"
        },
        {
          "name": "Erlang/OTP version ordering",
          "tags": [
            "x_version-scheme"
          ],
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        },
        {
          "name": "Fix commit 3983d49 in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-49759",
    "datePublished": "2026-06-10T14:35:38.838Z",
    "dateReserved": "2026-06-01T13:45:22.449Z",
    "dateUpdated": "2026-09-24T20:41:04.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49760",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T16:16:14.697009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T16:16:28.366Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "erl_interface"
          ],
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "lib/erl_interface/src/misc/ei_printterm.c"
          ],
          "programRoutines": [
            {
              "name": "ei_s_print_term"
            }
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "27.3.4.13",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "29.0.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "17.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "erl_interface"
          ],
          "packageName": "erl_interface",
          "packageURL": "pkg:otp/erl_interface?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "product": "OTP",
          "programFiles": [
            "src/misc/ei_printterm.c"
          ],
          "programRoutines": [
            {
              "name": "ei_s_print_term"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.5.2.1",
                  "status": "unaffected"
                },
                {
                  "at": "5.7.0.1",
                  "status": "unaffected"
                },
                {
                  "at": "5.8.1",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "3.7.16",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "erl_interface"
          ],
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "lib/erl_interface/src/misc/ei_printterm.c"
          ],
          "programRoutines": [
            {
              "name": "ei_s_print_term"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111",
              "status": "affected",
              "version": "84adefa331c4159d432d22840663c38f155cd4c1",
              "versionType": "git"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.3.4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.5.0.2",
                  "versionStartIncluding": "28.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.0.2",
                  "versionStartIncluding": "29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Sverker Eriksson"
        }
      ],
      "datePublic": "2026-06-10T14:35:36.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eStack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program file \u003ccode\u003elib/erl_interface/src/misc/ei_printterm.c\u003c/code\u003e and program routine \u003ccode\u003eei_s_print_term\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe C function \u003ccode\u003eei_s_print_term\u003c/code\u003e uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of \u003ccode\u003e0\u003c/code\u003e-\u003ccode\u003e9\u003c/code\u003e and \u003ccode\u003eA\u003c/code\u003e-\u003ccode\u003eF\u003c/code\u003e, which limits exploitation to Denial of Service.\u003c/p\u003e\n\u003cp\u003eThe companion function \u003ccode\u003eei_print_term\u003c/code\u003e, which prints directly to a \u003ccode\u003eFILE\u003c/code\u003e instead of a memory buffer, does not contain this bug.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;17.0 before OTP\u0026nbsp;27.3.4.13, OTP\u0026nbsp;28.5.0.2, and OTP\u0026nbsp;29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP\u0026nbsp;17.0, corresponding to erl_interface before 3.7.16, is affected is unknown.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file `lib/erl_interface/src/misc/ei_printterm.c` and program routine `ei_s_print_term`.\n\nThe C function `ei_s_print_term` uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of `0`-`9` and `A`-`F`, which limits exploitation to Denial of Service.\n\nThe companion function `ei_print_term`, which prints directly to a `FILE` instead of a memory buffer, does not contain this bug.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP\u00a017.0, corresponding to erl_interface before 3.7.16, is affected is unknown."
            }
          ],
          "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term.\n\nThe C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service.\n\nThe companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP\u00a017.0, corresponding to erl_interface before 3.7.16, is affected is unknown."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-8",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-8 Buffer Overflow in an API Call"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T20:42:47.418Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j"
        },
        {
          "name": "EEF CNA record for CVE-2026-49760",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-49760.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-49760",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49760"
        },
        {
          "name": "Erlang/OTP version ordering",
          "tags": [
            "x_version-scheme"
          ],
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        },
        {
          "name": "Fix commit 0bef277 in erlang/otp",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Stack Buffer Overflow in ei_s_print_term at Very Large Integer",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAvoid calling \u003ccode\u003eei_s_print_term\u003c/code\u003e with untrusted data whose encoded integer representation could exceed 2000 characters.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Avoid calling `ei_s_print_term` with untrusted data whose encoded integer representation could exceed 2000 characters."
            }
          ],
          "value": "Avoid calling ei_s_print_term with untrusted data whose encoded integer representation could exceed 2000 characters."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-49760",
    "datePublished": "2026-06-10T14:35:36.804Z",
    "dateReserved": "2026-06-01T13:45:22.449Z",
    "dateUpdated": "2026-09-24T20:42:47.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}