==================================================================== CERT-Renater Note d'Information No. 2026/VULN715 _____________________________________________________________________ DATE : 03/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running OTP versions prior to 29.0.3, 28.5.0.3, 27.3.4.14, ssl (OTP) versions prior to 11.7.3, 11.6.0.3, 11.2.12.10. ==================================================================== https://github.com/erlang/otp/security/advisories/GHSA-hwfc-5hf4-gvr3 https://github.com/erlang/otp/security/advisories/GHSA-8c57-44c9-pc59 https://github.com/erlang/otp/security/advisories/GHSA-gf6r-99xw-6qg6 https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9 https://github.com/erlang/otp/security/advisories/GHSA-p2m2-3c2w-8jp8 https://github.com/erlang/otp/security/advisories/GHSA-h9pw-h5w4-h976 _____________________________________________________________________ DTLS Denial of Service High lucioleKi published GHSA-hwfc-5hf4-gvr3 Package OTP Affected versions >= 25.3 Patched versions 29.0.3, 28.5.0.3, 27.3.4.14 ssl (OTP) >= 10.9 11.7.3, 11.6.0.3,11.2.12.10 Description Impact A DTLS server listener uses a single shared dtls_packet_demux gen_server process to route incoming UDP datagrams to the correct connection handler. When a DTLS client reconnects rapidly from the same source address and port (sending multiple ClientHello messages in quick succession), a race condition in the demux's internal gb_trees key-value store causes a {key_exists, {old, Client}} crash, terminating the demux process. Because the demux is shared across all DTLS associations on that listener, its crash immediately kills every active DTLS session — not just the attacker's. This is a pre-authentication attack: the attacker only needs to send UDP datagrams containing valid ClientHello messages from the same source IP:port before the intermediate DOWN monitor message is processed by the gen_server. The attack requires no credentials, no completed handshake, and no special configuration. Any DTLS listener accepting connections from untrusted networks is vulnerable. The attacker can repeat the crash indefinitely, creating a persistent denial of service for all clients of that listener. Affected/Unaffected Versions A version larger than or equal to one of the listed patched versions is unaffected; otherwise, a version that satisfies an expression listed under affected versions is affected, and if it does not, it is unaffected. The code enabling this was introduced in OTP-25.3. Credits Thanks to Lukas Backström at Erlang Solutions for finding and responsibly disclosing this vulnerability to the Erlang/OTP project. Severity High 8.7/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity None Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-55950 Weaknesses Weakness CWE-367 Credits @garazdawi garazdawi Reporter @IngelaAndin IngelaAndin Remediation developer @dgud dgud Remediation reviewer _____________________________________________________________________ Denial-of-Service for TLS-1.3 server Using Session Tickets High lucioleKi published GHSA-8c57-44c9-pc59 Package OTP Affected versions >= 22.2 Patched versions 29.0.3, 28.5.0.3, 27.3.4.14 ssl (otp) Affected versions >= 9.5 Patched versions 11.7.3, 11.6.0.3,11.2.12.10 Description Impact A TLS-1.3 server with session tickets enabled (stateful or stateless mode) can be permanently disrupted by a single unauthenticated client sending a malformed ClientHello with mismatched PSK identity and binder list lengths. The malformed message crashes the session ticket handler process. Ticket handler recovery flaws cause new TLS-1.3 connections complete the handshake but crash when attempting to issue session tickets, effectively making TLS-1.3 unusable until the affected listeners or the ssl application are restarted. TLS-1.2 connections are not affected. Affected/Unaffected Versions A version larger than or equal to one of the listed patched versions is unaffected; otherwise, a version that satisfies an expression listed under affected versions is affected, and if it does not, it is unaffected. The code enabling this was introduced in OTP-22.2. Credits Thanks to Lukas Backström at Erlang Solutions for finding and responsibly disclosing this vulnerability to the Erlang/OTP project. Severity High 8.2/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity None Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-55952 Weaknesses Weakness CWE-1284 Credits @garazdawi garazdawi Reporter @IngelaAndin IngelaAndin Remediation developer @dgud dgud Remediation reviewer @u3s u3s Remediation reviewer _____________________________________________________________________ Plaintext Injection Towards (D)TLS Client During Handshake Moderate lucioleKi published GHSA-gf6r-99xw-6qg6 Package OTP Affected versions >= 17.0 Patched versions 29.0.3, 28.5.0.3, 27.3.4.14 ssl (OTP) Affected versions >= 5.3.4 Patched versions 11.7.3, 11.6.0.3,11.2.12.10 Description Impact MITM could injected plaintext data before handshake completes that would be delivered to the TLS client application after a successful handshake. Injection window is smaller for TLS-1.3 than previous TLS versions. MITM can however not control the connection or force the client to act on the data or observe the possible reaction. Affected/Unaffected Versions A version larger than or equal to one of the listed patched versions is unaffected; otherwise, a version that satisfies an expression listed under affected versions is affected, and if it does not, it is unaffected. The documentation of the OTP version scheme describes how versions should be compared. Note that versions used prior to OTP 17.0, when the new OTP version scheme was introduced, are never listed since it is not well defined how to compare those versions. In the case of this vulnerability, versions prior to OTP 17.0 are also affected. Note TLS-1.3 was not supported until OTP-22.0 Credits Thanks to Lukas Backström at Erlang Solutions for finding and responsibly disclosing this vulnerability to the Erlang/OTP project. Severity Moderate 6.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity High Attack Requirements Present Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity Low Availability None Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVE ID CVE-2026-54891 Weaknesses Weakness CWE-924 Credits @garazdawi garazdawi Reporter @IngelaAndin IngelaAndin Remediation developer @u3s u3s Remediation reviewer _____________________________________________________________________ SSH SFTP server denial of service via extended data infinite loop Moderate lucioleKi published GHSA-7wp4-pc27-2vj9 Package OTP Affected versions >= 17.0 Patched versions 29.0.3, 28.5.0.3, 27.3.4.14 ssh (OTP) Affected versions >= 3.0.1 Patched versions 6.0.2, 5.5.2.2, 5.2.11.9 Description Impact The handle_data/4 function in ssh_sftpd.erl (line ~238) contains a catch-all clause that accepts channel data with any Type value. When Type ≠ 0 (i.e., SSH_MSG_CHANNEL_EXTENDED_DATA) is received with an empty pending buffer and payload ≤ 256 KiB, the clause tail-calls itself with identical arguments — creating an infinite loop that makes the channel process permanently unresponsive. The SFTP protocol operates exclusively on normal channel data (Type = 0). Extended data (Type ≠ 0) is meaningless for SFTP and is never sent by conforming clients. However, the SSH protocol permits any channel participant to send extended data on an open channel. An authenticated SFTP client can exploit this by sending SSH_MSG_CHANNEL_EXTENDED_DATA with any data_type_code (e.g., 1 for stderr) and any non-empty payload to an established SFTP channel. The targeted ssh_sftpd process enters an infinite tail-recursive loop: it never processes another message, its message queue grows without bound, and it can only be stopped via exit(Pid, kill). BEAM's reduction-based scheduler preemption continues to function — other processes on the node are not starved. However, each stuck channel process consumes its full CPU time share continuously and accumulates unbounded message queue memory. Opening many channels amplifies the CPU and memory impact. No file contents, credentials, or write access are obtainable through this issue. The impact is limited to denial of service on targeted SFTP channels, with secondary CPU degradation and memory growth. Note that Erlang/OTP SSH configurations using the default max_channels setting (infinity) allow an authenticated user to open unlimited channels per connection, amplifying the attack without requiring multiple TCP connections or authentications. Workarounds Set the max_channels daemon option to a finite value (e.g., {max_channels, 10}) to limit the number of channels an attacker can open per connection Set the max_sessions daemon option to limit total concurrent SSH connections to the daemon Use external process monitoring to detect and kill ssh_sftpd processes with abnormally high reduction counts and growing message queues Ensure that the SFTP server port is not reachable from untrusted machines Affected/Unaffected Versions A version larger than or equal to one of the listed patched versions is unaffected; otherwise, a version that satisfies an expression listed under affected versions is affected, and if it does not, it is unaffected. The documentation of the OTP version scheme describes how versions should be compared. Note that versions used prior to OTP 17.0, when the new OTP version scheme was introduced, are never listed since it is not well defined how to compare those versions. In the case of this vulnerability, versions prior to OTP 17.0 are also affected. Credits Thanks to Lukas Backström at Erlang Solutions for finding and responsibly disclosing this vulnerability to the Erlang/OTP project. Severity Moderate 5.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements None Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity None Availability Low Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVE ID CVE-2026-54886 Weaknesses Weakness CWE-400 Weakness CWE-835 Credits @garazdawi garazdawi Reporter @Mikaka27 Mikaka27 Remediation developer @u3s u3s Remediation reviewer _____________________________________________________________________ DTLS Cookie Bypass During Startup Moderate lucioleKi published GHSA-p2m2-3c2w-8jp8 Package OTP Affected versions >= 20.0 Patched versions 29.0.3, 28.5.0.3, 27.3.4.14 ssl (OTP) Affected versions >= 8.2 Patched versions 11.7.3, 11.6.0.3,11.2.12.10 Description Impact Initial previous_cookie_secret is initialized to the emty binary , A HMAC with empty key is deterministic and predictable. Anyone who knows the HMAC algorithm and the ClientHello contents can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) and forge a valid cookie before the first rotation of cookie value. The DTLS cookie (RFC 6347 §4.2.1) is a DoS mitigation — it prevents attackers from using spoofed source IPs to force the server to allocate state and perform expensive crypto operations (amplification attack). It is NOT an authentication mechanism. During the window from server startup until first secret rotation (0-15s), an attacker who can observe the plaintext ClientHello can compute the valid cookie (HMAC-SHA1(<<>>, known_data)) and bypass the address verification. Affected/Unaffected Versions A version larger than or equal to one of the listed patched versions is unaffected; otherwise, a version that satisfies an expression listed under affected versions is affected, and if it does not, it is unaffected. The code setting the initial cookie to the empty binary was introduced in OTP-20, however previous versions DTLS was not supported the code was only an experimental prototype that hardcoded the cookie. Credits Thanks to Lukas Backström at Erlang Solutions for finding and responsibly disclosing this vulnerability to the Erlang/OTP project. Severity Moderate 6.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required None User interaction None Vulnerable System Impact Metrics Confidentiality None Integrity None Availability Low Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVE ID CVE-2026-54887 Weaknesses Weakness CWE-1394 Credits @garazdawi garazdawi Reporter @IngelaAndin IngelaAndin Remediation developer @dgud dgud Remediation reviewer _____________________________________________________________________ OTP ssh_sftpd REALPATH Path Existence Oracle ( File system Enumeration ) Low lucioleKi published GHSA-h9pw-h5w4-h976 Package OTP Affected versions >= 17.0 Patched versions 29.0.3, 28.5.0.3, 27.3.4.14 ssh (OTP) Affected versions >= 3.0.1 Patched versions 6.0.2, 5.5.2.2, 5.2.11.9 Description Impact The SSH_FXP_REALPATH handler in ssh_sftpd passes Canonicalizeúlse to relate_file_name/3 (ssh_sftpd.erl, line ~328), unlike every other SFTP operation handler which uses the default Canonicalize=true. This allows .. path components to bypass the is_within_root/2 check without resolution. The un-canonicalized path then enters resolve_symlinks/2, which processes .. by walking up the directory tree, making read_link() syscalls on arbitrary filesystem paths outside the configured root. An authenticated SFTP client can exploit this by sending a REALPATH request with a crafted traversal path (e.g., //../../../etc/passwd). The response differs depending on whether the target path exists on the server filesystem: Path exists outside root → SSH_FXP_NAME (success, path resolved, clipped by chroot_filename) Path does NOT exist → SSH_FX_NO_SUCH_FILE (error, resolve_symlinks failed) This creates a path-existence oracle that allows full filesystem structure enumeration. An authenticated SFTP user can confirm the existence of sensitive files (/etc/shadow, private keys, database files, config files), discover directories and services, map internal network structure via mounted shares, and perform reconnaissance for further attacks. No file contents, credentials, or write access are obtainable through this issue alone. Note that Erlang/OTP SFTP server configurations that do not use the root option allow remote file access anywhere on the system with absolute or relative file paths, which is a known property of the SFTP protocol. This cannot be considered a vulnerability in itself. For a system to be vulnerable, the system designer must have configured the root option under the assumption that it provides complete filesystem path isolation. The oracle may reveal host directory structure, installed software, mount point names, or usernames. On its own this does not enable file access or modification, but it may assist further attacks if combined with other vulnerabilities. Workarounds Use OS-level chroot to run the Erlang VM/SFTP server process in an isolated filesystem environment, eliminating reliance on the application-level root option Ensure that the SFTP server port on the machine running the Erlang/OTP SFTP server is not reachable from untrusted machines Ensure that no sensitive information (usernames, project names, mount topology) is inferrable from the existence or non-existence of paths on the host filesystem Affected/Unaffected Versions A version larger than or equal to one of the listed patched versions is unaffected; otherwise, a version that satisfies an expression listed under affected versions is affected, and if it does not, it is unaffected. The documentation of the OTP version scheme describes how versions should be compared. Note that versions used prior to OTP 17.0, when the new OTP version scheme was introduced, are never listed since it is not well defined how to compare those versions. In the case of this vulnerability, versions prior to OTP 17.0 are also affected. Credits Thanks to Mohamed Ali IBNAL HAJALI at Ericsson for finding and responsibly disclosing this vulnerability to the Erlang/OTP project. Severity Low 2.3/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity Low Attack Requirements Present Privileges Required Low User interaction None Vulnerable System Impact Metrics Confidentiality Low Integrity None Availability None Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVE ID CVE-2026-53422 Weaknesses Weakness CWE-204 Credits @sanfourghodhben sanfourghodhben Reporter @Mikaka27 Mikaka27 Remediation developer @u3s u3s Remediation reviewer ======================================================== + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + ========================================================