CVE-2026-49759
published 2026-06-10CVE-2026-49759: Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted…
PriorityP351high8.2CVSS 3.1
AVNACLPRNUINSUCLINAH
EPSS
0.50%
38.8th percentile
Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk.
The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exploitation to Denial of Service.
A crafted SCTP ERROR chunk may also leak bits and pieces of Erlang VM memory into the received error packet observed by the Erlang process. Such data is already readable by the user running the Erlang VM, so the disclosure scope is limited.
This issue affects OTP from OTP 17.0 before 27.3.4.13, 28.5.0.2 and 29.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2 and 17.0.2.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | erlang | — | — |
| erlang | erlang_otp | >= 17.0 < 27.3.4.13 | 27.3.4.13 |
| erlang | erlang_otp | >= 28.0 < 28.5.0.2 | 28.5.0.2 |
| erlang | erlang_otp | >= 29.0 < 29.0.2 | 29.0.2 |
| erlang | erts | >= 16.0 < 16.4.0.2 | 16.4.0.2 |
| erlang | erts | >= 17.0 < 17.0.2 | 17.0.2 |
| erlang | erts | >= 6.0 < 15.2.7.9 | 15.2.7.9 |
| erlang | otp | >= 17.0 < * | * |
| erlang | otp | >= 6.0 < * | * |
| erlang | otp | >= 84adefa331c4159d432d22840663c38f155cd4c1 < 3983d495284331c121f600a80bac9fcf4e16381e | 3983d495284331c121f600a80bac9fcf4e16381e |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
nvdv4.08.8HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Erlang OTP up to 16.x/17.0.1/29.0.1 SCTP inet_drv.c sctp_parse_error_chunk spec[] stack-based overflow (GHSA-6f4f-chj5-5g97)
vuldb·2026-06-10·CVSS 8.8
CVE-2026-49759 [HIGH] Erlang OTP up to 16.x/17.0.1/29.0.1 SCTP inet_drv.c sctp_parse_error_chunk spec[] stack-based overflow (GHSA-6f4f-chj5-5g97)
A vulnerability described as critical has been identified in Erlang OTP up to 16.x/17.0.1/29.0.1. The affected element is the function sctp_parse_error_chunk of the file erts/emulator/drivers/common/inet_drv.c of the component SCTP Handler. The manipulation of the argument spec[] results in stack-based buffer overflow.
This vulnerability is known as CVE-2026-49759. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
Red Hat
erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk
vendor_redhat·2026-06-10·CVSS 8.2
CVE-2026-49759 [HIGH] CWE-120 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk
erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk
Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk.
The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exp
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk [epel-all]
bugzilla·2026-06-17·CVSS 8.2
CVE-2026-49759 [HIGH] CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk [epel-all]
CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk [fedora-all]
bugzilla·2026-06-17·CVSS 8.2
CVE-2026-49759 [HIGH] CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk [fedora-all]
CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk
bugzilla·2026-06-10·CVSS 8.2
CVE-2026-49759 [HIGH] CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk
CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk
Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk.
The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return addre
https://cna.erlef.org/cves/CVE-2026-49759.htmlhttps://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381ehttps://github.com/erlang/otp/security/advisories/GHSA-6f4f-chj5-5g97https://osv.dev/vulnerability/EEF-CVE-2026-49759https://www.erlang.org/doc/system/versions.html#order-of-versionshttps://access.redhat.com/security/cve/CVE-2026-49759https://bugzilla.redhat.com/show_bug.cgi?id=2487607https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49759.json
2026-06-10
Published