PT-2026-64993 · Unknown+1 · Erlang/Otp+1
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
erlang otp versions 27.0 through 27.3.4.14
erlang otp version 28.5.0.3
erlang otp versions 29.0 through 29.0.3
erts versions 15.0 through 15.2.7.10
erts version 16.4.0.3
erts versions 17.0 through 17.0.3
Description
An integer underflow exists in the External Term Format (ETF) decoder within the
BIT BINARY EXT tag (77) handler. When the decoder accepts an encoding where both length and trailing-bits fields are set to zero, the bitstring size computation underflows an unsigned integer. This results in an extremely large value (approximately 2^64) being passed as a memory allocation size, causing the allocator to abort the entire node. This VM-level abort cannot be intercepted by supervision trees, try/catch blocks, or the [safe] option in binary to term/2. Applications decoding ETF from untrusted sources using binary to term/1,2 or enif binary to term() are exposed. The Erlang distribution protocol also uses this code path, though it is intended for trusted networks.Recommendations
Update erlang otp to version 27.3.4.15, 28.5.0.4, or 29.0.4.
Update erts to version 15.2.7.11, 16.4.0.4, or 17.0.4.
Avoid calling
binary to term/1,2 or enif binary to term() on data from untrusted sources.
Use alternative serialization formats such as JSON or Protocol Buffers instead of ETF for untrusted input.Fix
Integer Underflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Erts
Erlang/Otp