John Högberg

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 21.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5 stdlib versions 3.5 through 6.2.2.4 stdlib versions 7.0 through 7.3.0.1 stdlib versions 8.0 through 8.0.3 **Description** Improper validation of input quantity in the stdlib allows a remote attacker to degrade availability by providing a URI with a port component consisting of an excessively long sequence of digits. The function `uri string:get port/1` passes the port substring to `binary to integer/1` without a length bound. Consequently, a syntactically valid port of up to approximately 1.26 million digits can be converted successfully, consuming hundreds of milliseconds of arbitrary-precision arithmetic in the calling process. This conversion is triggered via every authority-parsing path in `uri string:parse/1`, including host, registered-name, and IPv4 and IPv6 forms. Any application using `uri string:parse/1` to parse attacker-supplied URIs is exposed. **Recommendations** Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later. Update stdlib to version 6.2.2.5 or later. Update stdlib to version 7.3.0.2 or later. Update stdlib to version 8.0.4 or later.

[Content removed]

**Name of the Vulnerable Software and Affected Versions** Erlang OTP versions 27.1 through 27.3.4.14 Erlang OTP versions 28.0 through 28.5.0.3 Erlang OTP versions 29.0 through 29.0.3 **Description** A relative path traversal issue in the stdlib zip module allows writing files outside the intended extraction directory when processing a crafted zip archive. The functions `zip:unzip/1,2` and `zip:extract/1,2` use `zip:check dir level/2` to validate entry paths by tracking directory depth with an integer counter. Because the validation only rejects paths where the final counter value is negative, a path like `../x/y` can cause the counter to go negative during traversal and then return to zero, bypassing the check and resolving to a location outside the extraction directory via `add cwd`. This issue is located in the `lib/stdlib/src/zip.erl` file. **Recommendations** Update Erlang OTP to version 27.3.4.15 or later. Update Erlang OTP to version 28.5.0.4 or later. Update Erlang OTP to version 29.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 23.2 through 27.3.4.14 Erlang/OTP version 28.5.0.3 Erlang/OTP version 29.0.3 **Description** The ssl application fails to detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. Specifically, the function `handle incomplete chain/5` passes the chain to `build certificate chain/5`, which then uses `do certificate chain/7` to walk issuer relationships without a depth limit or cycle detection. If a peer provides two mutually cross-signed certificates in an unordered form, the system recurses indefinitely, causing the call stack and chain accumulator to grow without bound. An unauthenticated remote attacker can exploit this by sending a crafted certificate chain in a handshake message to exhaust memory and crash the BEAM node. This affects both servers and clients and requires only a TCP connection and a partial handshake. **Recommendations** Update Erlang/OTP to version 27.3.4.15 or later. Update Erlang/OTP to version 28.5.0.4 or later. Update Erlang/OTP to version 29.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** erlang otp versions 27.0 through 27.3.4.14 erlang otp version 28.5.0.3 erlang otp versions 29.0 through 29.0.3 erts versions 15.0 through 15.2.7.10 erts version 16.4.0.3 erts versions 17.0 through 17.0.3 **Description** An integer underflow exists in the External Term Format (ETF) decoder within the `BIT BINARY EXT` tag (77) handler. When the decoder accepts an encoding where both length and trailing-bits fields are set to zero, the bitstring size computation underflows an unsigned integer. This results in an extremely large value (approximately 2^64) being passed as a memory allocation size, causing the allocator to abort the entire node. This VM-level abort cannot be intercepted by supervision trees, try/catch blocks, or the `[safe]` option in `binary to term/2`. Applications decoding ETF from untrusted sources using `binary to term/1,2` or `enif binary to term()` are exposed. The Erlang distribution protocol also uses this code path, though it is intended for trusted networks. **Recommendations** Update erlang otp to version 27.3.4.15, 28.5.0.4, or 29.0.4. Update erts to version 15.2.7.11, 16.4.0.4, or 17.0.4. Avoid calling `binary to term/1,2` or `enif binary to term()` on data from untrusted sources. Use alternative serialization formats such as JSON or Protocol Buffers instead of ETF for untrusted input.