EEF-CVE-2026-49759

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-49759.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-49759.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-49759
Aliases
  • CVE-2026-49759
  • GHSA-6f4f-chj5-5g97
Published
2026-06-10T14:35:38.838Z
Modified
2026-06-10T20:04:33.061881Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
Details

Summary

Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk.

The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exploitation to Denial of Service.

A crafted SCTP ERROR chunk may also leak bits and pieces of Erlang VM memory into the received error packet observed by the Erlang process. Such data is already readable by the user running the Erlang VM, so the disclosure scope is limited.

This issue affects OTP from OTP 17.0 before 27.3.4.13, 28.5.0.2 and 29.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2 and 17.0.2.

Configuration

SCTP support must be compiled into OTP. A listening SCTP socket must be opened via gen_sctp with the default inet backend and must be reachable from the attacker's network. Windows builds are unaffected as SCTP is not supported on Windows.

Database specific 
{
    "cpe_ids": [
        "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
    ],
    "capec_ids": [
        "CAPEC-100"
    ],
    "cwe_ids": [
        "CWE-121"
    ]
}
References
Credits
    • Zhang Delong - FINDER
    • Raimo Niskanen - REMEDIATION_DEVELOPER

Affected packages

Git / github.com/erlang/otp

Affected ranges

Type
GIT
Repo
https://github.com/erlang/otp
Events
Introduced
84adefa331c4159d432d22840663c38f155cd4c1
Fixed
3983d495284331c121f600a80bac9fcf4e16381e

Affected versions

OTP-17.*
OTP-17.0
OTP-18.*
OTP-18.0
OTP-18.0-rc1
OTP-19.*
OTP-19.0
OTP-19.0-rc1
OTP-19.0-rc2
OTP-20.*
OTP-20.0
OTP-20.0-rc1
OTP-20.0-rc2
OTP-21.*
OTP-21.0
OTP-21.0-rc1
OTP-21.0-rc2
OTP-22.*
OTP-22.0
OTP-22.0-rc1
OTP-22.0-rc2
OTP-22.0-rc3
OTP-23.*
OTP-23.0
OTP-23.0-rc1
OTP-23.0-rc2
OTP-23.0-rc3
OTP-24.*
OTP-24.0
OTP-24.0-rc1
OTP-24.0-rc2
OTP-24.0-rc3
OTP-25.*
OTP-25.0
OTP-25.0-rc1
OTP-25.0-rc2
OTP-25.0-rc3
OTP-26.*
OTP-26.0
OTP-26.0-rc1
OTP-26.0-rc2
OTP-26.0-rc3
OTP-27.*
OTP-27.0
OTP-27.0-rc1
OTP-27.0-rc2
OTP-27.0-rc3
OTP_17.*
OTP_17.0-rc1
OTP_17.0-rc2
Other
OTP_R13B03
OTP_R13B04
OTP_R14A
OTP_R14B
OTP_R14B01
OTP_R14B02
OTP_R14B03
OTP_R15A
OTP_R15B
OTP_R16A_RELEASE_CANDIDATE
OTP_R16B

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-49759.json"
vanir_signatures_modified 
"2026-06-10T20:04:33Z"
vanir_signatures 
[
    {
        "digest": {
            "length": 2014.0,
            "function_hash": "184595612234859676917183599415578389295"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "EEF-CVE-2026-49759-086bea98",
        "signature_version": "v1",
        "source": "https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e",
        "target": {
            "function": "inet_async_binary_data",
            "file": "erts/emulator/drivers/common/inet_drv.c"
        }
    },
    {
        "digest": {
            "length": 5276.0,
            "function_hash": "263087288147412016441621247204345143430"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "EEF-CVE-2026-49759-195adcd4",
        "signature_version": "v1",
        "source": "https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e",
        "target": {
            "function": "sctp_parse_async_event",
            "file": "erts/emulator/drivers/common/inet_drv.c"
        }
    },
    {
        "digest": {
            "length": 622.0,
            "function_hash": "134964009648278391633855208643986952183"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "EEF-CVE-2026-49759-25349053",
        "signature_version": "v1",
        "source": "https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e",
        "target": {
            "function": "sctp_parse_error_chunk",
            "file": "erts/emulator/drivers/common/inet_drv.c"
        }
    },
    {
        "digest": {
            "length": 1745.0,
            "function_hash": "212381888890855358144507079767802110502"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "EEF-CVE-2026-49759-621769b4",
        "signature_version": "v1",
        "source": "https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e",
        "target": {
            "function": "packet_binary_message",
            "file": "erts/emulator/drivers/common/inet_drv.c"
        }
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "35199189876955723439301501077462724340",
                "69566737717372723756936899222425033529",
                "331885875175311165743398316662508303043",
                "305939554633809701636632760240711840206",
                "19353231045043652650638943209376768802",
                "207237543106577869041957563288073749342",
                "272942461122145271473565461630325252527",
                "23649052473293114297988654405786877852",
                "216190312775164234008634233146715832204",
                "329750009350937384279365785034827689870",
                "296694530608044197811507853404339850164",
                "256550367793661220479974896005579946992",
                "90380030959621263838460525312832674746",
                "302876060500427763376208474281914386429",
                "200539201971724794838730878958259856581",
                "137634340062719920132890378306500421203",
                "330746806811552684481987330208542018371",
                "192084599746412264540276695843449632552",
                "53018060785394966210489639736961601605",
                "68510878564539394961494273843221629281",
                "110662890476868889312214323360656808784",
                "252946761670747216266262843414467973516",
                "168489334789993084675100682493832852870",
                "54702169777306127760022041153703734769",
                "40822024253214854379854660987485367425",
                "228244314934678221904786507502365921752",
                "127902405776683230798863557873496042499",
                "48586416285992254395403095891650090998",
                "105683795941385293427813569753857975442",
                "214152516172552623437822286087118157171",
                "336813375040442904203109166733687482672",
                "71236968827981185783463054935246515012",
                "149465361002832387273019816038114017231",
                "140706362948630945573987848937778618148",
                "210221572057145640057554266889452468964",
                "127667843362853846049490396498468133171",
                "41798998782867138930082674339862255750",
                "162284894054099809865922609392294908323",
                "9746454326127136776026969353219706652",
                "182314730203965631544430499332460949998",
                "97687767982730990052397956496074097225",
                "239249787659226760664233690540776602532",
                "20240127551134495349194635476042812297",
                "171370655105177113661057354310273846143",
                "89903313949605223940231165058469183194",
                "4307205435339945389812432758784017474",
                "131548505294419077956935100558337255157",
                "24269589780803649459639207065042450828",
                "89358100492938086060160258165748687519",
                "207933301977921976734120571521786929199",
                "29674795074769823601487128582050423188",
                "290193128360864364740185289200268505741",
                "202245167282000692603742788791251602827",
                "25449616315732842503049499921507306119",
                "153565637225120413496756781843850768576",
                "241032259614038241220674916997178132762",
                "10732998826764039925219482330324401992",
                "190083651049690826034078163304230161753",
                "246487764680494062808021872459823417484",
                "288000563547659463958914887134204285059",
                "301028201626820946138349137487565923735"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "EEF-CVE-2026-49759-b2e6c1c4",
        "signature_version": "v1",
        "source": "https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e",
        "target": {
            "file": "erts/emulator/drivers/common/inet_drv.c"
        }
    }
]