Lukas Backström

**Name of the Vulnerable Software and Affected Versions** erlang otp versions 27.0 through 27.3.4.14 erlang otp version 28.5.0.3 erlang otp versions 29.0 through 29.0.3 erts versions 15.0 through 15.2.7.10 erts version 16.4.0.3 erts versions 17.0 through 17.0.3 **Description** An integer underflow exists in the External Term Format (ETF) decoder within the `BIT BINARY EXT` tag (77) handler. When the decoder accepts an encoding where both length and trailing-bits fields are set to zero, the bitstring size computation underflows an unsigned integer. This results in an extremely large value (approximately 2^64) being passed as a memory allocation size, causing the allocator to abort the entire node. This VM-level abort cannot be intercepted by supervision trees, try/catch blocks, or the `[safe]` option in `binary to term/2`. Applications decoding ETF from untrusted sources using `binary to term/1,2` or `enif binary to term()` are exposed. The Erlang distribution protocol also uses this code path, though it is intended for trusted networks. **Recommendations** Update erlang otp to version 27.3.4.15, 28.5.0.4, or 29.0.4. Update erts to version 15.2.7.11, 16.4.0.4, or 17.0.4. Avoid calling `binary to term/1,2` or `enif binary to term()` on data from untrusted sources. Use alternative serialization formats such as JSON or Protocol Buffers instead of ETF for untrusted input.

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 26.2 through 27.3.4.14 Erlang/OTP versions 28.0 through 28.5.0.3 Erlang/OTP versions 29.0 through 29.0.3 public key versions 1.15 through 1.17.1.4 public key versions 1.20 through 1.20.3.3 public key versions 1.21 through 1.21.3 **Description** Resource allocation without limits in the certificate path validation of the public key module allows a remote unauthenticated attacker to cause a denial of service. By sending a crafted X.509 certificate chain during a TLS handshake, an attacker can trigger unbounded growth of the certificate policy tree during RFC 5280 policy processing in the `pkix path validation/3` function. This occurs because the functions `pubkey policy tree:add leaves/2` and `pubkey policy tree:add leaf siblings/2` extend the tree per policy per certificate, leading to exponential growth. This can pin BEAM schedulers and exhaust node memory, resulting in a complete virtual machine crash. The issue affects any incoming or outgoing TLS connection that validates the peer's chain, such as SSL/TLS clients and mutual-TLS servers. **Recommendations** Update Erlang/OTP to version 27.3.4.15, 28.5.0.4, or 29.0.4. Update public key to version 1.17.1.5, 1.20.3.4, or 1.21.4.

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 23.2 through 27.3.4.14 Erlang/OTP version 28.5.0.3 Erlang/OTP version 29.0.3 **Description** The ssl application fails to detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. Specifically, the function `handle incomplete chain/5` passes the chain to `build certificate chain/5`, which then uses `do certificate chain/7` to walk issuer relationships without a depth limit or cycle detection. If a peer provides two mutually cross-signed certificates in an unordered form, the system recurses indefinitely, causing the call stack and chain accumulator to grow without bound. An unauthenticated remote attacker can exploit this by sending a crafted certificate chain in a handshake message to exhaust memory and crash the BEAM node. This affects both servers and clients and requires only a TCP connection and a partial handshake. **Recommendations** Update Erlang/OTP to version 27.3.4.15 or later. Update Erlang/OTP to version 28.5.0.4 or later. Update Erlang/OTP to version 29.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 17.0 through 29.0.2 Erlang/OTP versions 28.x prior to 28.5.0.3 Erlang/OTP versions 27.x prior to 27.3.4.14 **Description** Improper enforcement of message integrity during transmission in the `tls gen connection` module allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function `handle protocol record()` fails to reject APPLICATION DATA records that arrive in pre-handshake states when the endpoint acts as a client. An attacker can send plaintext APPLICATION DATA records during the handshake, which are buffered and delivered to the application as authenticated post-handshake data once the handshake completes. This results in the blind injection of unauthenticated bytes. The injection window is wider for TLS versions prior to TLS 1.3 than for TLS 1.3. **Recommendations** Update Erlang/OTP to version 29.0.3 or later. Update Erlang/OTP to version 28.5.0.3 or later. Update Erlang/OTP to version 27.3.4.14 or later.

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 22.2 through 29.0.2 Erlang/OTP version 28.5.0.3 Erlang/OTP version 27.3.4.14 ssl versions 9.5 through 11.7.2 ssl version 11.6.0.3 ssl version 11.2.12.10 **Description** The ssl application fails to validate that the PSK identity list and binder list in a TLS 1.3 ClientHello pre-shared key extension have equal length. In the function `handle pre shared key/3`, an `OfferedPreSharedKeys` record with mismatched lengths is passed to `use/4`, causing the session ticket handler process to crash. An unauthenticated remote attacker can send a crafted ClientHello to a TLS 1.3 server with session tickets enabled to disrupt session ticket handling. While new TLS 1.3 handshakes may complete, they crash when the server attempts to issue a session ticket, rendering TLS 1.3 unusable on the listener until the application is restarted. TLS 1.2 connections are not affected. **Recommendations** Update Erlang/OTP to version 29.0.3 or later. Update Erlang/OTP to a version newer than 28.5.0.3. Update Erlang/OTP to a version newer than 27.3.4.14. Update ssl to version 11.7.3 or later. Update ssl to a version newer than 11.6.0.3. Update ssl to a version newer than 11.2.12.10. Disable session tickets on TLS 1.3 servers by setting `session tickets` to disabled in the server's ssl options. Restrict the server to TLS 1.2 by setting `versions` to `['tlsv1.2']` in the server's ssl options.

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 25.3 through 29.0.2 Erlang/OTP versions 28.x prior to 28.5.0.3 Erlang/OTP versions 27.x prior to 27.3.4.14 ssl versions 10.9 through 11.7.2 ssl versions 11.6.x prior to 11.6.0.3 ssl versions 11.2.x prior to 11.2.12.10 **Description** A Time-of-check Time-of-use (TOCTOU) race condition exists in the `dtls packet demux` module within the ssl component. This occurs when a DTLS server listener uses a shared `dtls packet demux` `gen server` process to route UDP datagrams. An unauthenticated remote attacker can trigger a crash by rapidly sending multiple ClientHello messages from the same source address and port. This creates a race condition in the internal `gb trees` key-value store, resulting in a `{key exists, {old, Client}}` crash that terminates the demux process. Since this process is shared, all active DTLS sessions on the listener are terminated, leading to a persistent denial of service. The issue is located in the file `lib/ssl/src/dtls packet demux.erl` and only affects deployments using `ssl:listen/2` with UDP-based transport. **Recommendations** Update Erlang/OTP to version 29.0.3 or later. Update Erlang/OTP to version 28.5.0.3 or later. Update Erlang/OTP to version 27.3.4.14 or later. Update ssl to version 11.7.3 or later. Update ssl to version 11.6.0.3 or later. Update ssl to version 11.2.12.10 or later.

**Name of the Vulnerable Software and Affected Versions** Erlang OTP versions 17.0 through 29.0.3 Erlang OTP version 28.5.0.3 Erlang OTP version 27.3.4.14 **Description** An infinite loop exists in the `ssh sftpd` module of Erlang OTP. An authenticated SFTP user can cause an SFTP channel to become permanently unresponsive by sending `SSH MSG CHANNEL EXTENDED DATA` with a non-zero type code, an empty pending buffer, and a payload within the SFTP packet size limit. This triggers a tail-recursive loop in the `handle data()` function, causing the process to stop processing messages and leading to unbounded message queue memory growth and high CPU consumption. The impact is a denial of service on targeted SFTP channels. This effect can be amplified if the `max channels` setting is set to infinity, allowing a single user to open unlimited channels. **Recommendations** Update Erlang OTP to a version newer than 29.0.3, 28.5.0.3, and 27.3.4.14. Set the `max channels` daemon option to a finite value to limit channels per connection. Set the `max sessions` daemon option to limit total concurrent SSH connections. Use external process monitoring to identify and terminate `ssh sftpd` processes exhibiting high reduction counts and growing message queues. Restrict access to the SFTP server port to trusted machines only.

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 20.0 through 29.0.2 Erlang/OTP versions 28.0 through 28.5.0.2 Erlang/OTP versions 27.0 through 27.3.4.13 ssl versions 8.2 through 11.7.2 ssl versions 11.6.0 through 11.6.0.2 ssl versions 11.2.0 through 11.2.12.9 **Description** Use of a default cryptographic key in the DTLS server allows for predictable DTLS cookie computation during the startup window, which enables the bypass of source address verification. Upon server startup, the function `dtls server connection:initial hello/3` initializes the `previous cookie secret` variable to an empty binary instead of a random value. Since HMAC with an empty key is deterministic, an attacker observing the plaintext ClientHello can compute the `dtls handshake:cookie()` and forge a valid DTLS cookie before the first secret rotation occurs (typically within 0 to 15 seconds). This allows for DTLS handshake amplification using spoofed source addresses, bypassing the denial-of-service mitigation intended to prevent spoofed IPs from forcing the server to allocate state and perform expensive cryptographic operations. **Recommendations** Update Erlang/OTP to version 29.0.3, 28.5.0.3, or 27.3.4.14. Update ssl to version 11.7.3, 11.6.0.3, or 11.2.12.10.

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 26.0 through 29.0.1 Erlang/OTP version 28.5.0.1 and earlier Erlang/OTP version 27.3.4.12 and earlier ssl versions 11.0 through 11.7.1 ssl version 11.6.0.1 and earlier ssl version 11.2.12.8 and earlier **Description** An issue in the `inet tls dist` module allows an unauthenticated bypass of the LAN allowlist for Erlang distribution over TLS. The `check ip()` function incorrectly calls `sockname()` instead of `peername()` to retrieve the peer's IP address. Since `sockname()` returns the local socket address, the subnet mask comparison always succeeds regardless of the actual remote address. Consequently, any holder of a CA-signed TLS certificate can bypass LAN restrictions and gain full distribution access to the node, including the ability to use `rpc:call()` and `code:load binary()` functions. **Recommendations** Update Erlang/OTP to version 29.0.2, 28.5.0.2, or 27.3.4.13. Update ssl to version 11.7.2, 11.6.0.2, or 11.2.12.9. Implement a custom `verify fun` SSL option that correctly checks the peer IP address using `peername()` on the socket.

**Name of the Vulnerable Software and Affected Versions** Erlang OTP versions 17.0 through 28.0.1 Erlang OTP version 27.3.4.1 Erlang OTP version 26.2.5.13 stdlib versions 2.0 through 7.0.1 stdlib version 6.2.2.1 stdlib version 5.2.3.4 **Description** The issue is related to a Path Traversal vulnerability in Erlang OTP, specifically in the stdlib modules. This vulnerability allows Absolute Path Traversal and File Manipulation. It is associated with the program files lib/stdlib/src/zip.erl and the routines `zip:unzip/1`, `zip:unzip/2`, `zip:extract/1`, and `zip:extract/2`, unless the memory option is used. **Recommendations** For Erlang OTP versions 17.0 through 28.0.1, consider disabling the `zip:unzip/1` and `zip:unzip/2` functions until a patch is available. For Erlang OTP version 27.3.4.1, restrict access to the `zip:extract/1` and `zip:extract/2` routines to minimize the risk of exploitation. For Erlang OTP version 26.2.5.13, avoid using the `zip` module until the issue is resolved. For stdlib versions 2.0 through 7.0.1, consider applying configuration changes to limit the impact of the vulnerability. For stdlib version 6.2.2.1, restrict access to the vulnerable `zip.erl` file to prevent exploitation. For stdlib version 5.2.3.4, consider disabling the `zip` module as a temporary workaround until a patch is available.