[UPDATE] [medium] Erlang/OTP: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Erlang/OTP to bypass security precautions, manipulate data, disclose confidential information, or cause a denial-of-service condition.
CSIRTS triage
- What
- An attacker can exploit multiple vulnerabilities in Erlang/OTP to bypass security precautions, manipulate data, disclose confidential information, or cause a denial-of-service condition.
- Who is affected
- Deployments of Erlang/OTP are affected.
- Urgency
- Remediation is medium urgency due to the potential for various impacts including denial of service.
- Action
- Update Erlang/OTP to the latest version to address these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Erlang/OTP
Get an email when a new Erlang/OTP advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1887
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-488550.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
- Low exploitation riskCVE-2026-488560.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.
- Low exploitation riskCVE-2026-488580.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all scored CVEs.
- Low exploitation riskCVE-2026-488590.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all scored CVEs.
- Low exploitation riskCVE-2026-488600.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
- Low exploitation riskCVE-2026-497590.50% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all scored CVEs.
- Low exploitation riskCVE-2026-497600.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-48855 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48856 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48858 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48859 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48860 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-49759 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-49760 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highCVE-2026-49759: Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crashmsrc
- mediumCVE-2026-49760: Stack Buffer Overflow in ei_s_print_term at Very Large Integermsrc
- mediumCVE-2026-48858: ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce a…msrc
- mediumCVE-2026-48856: httpc leaks Authorization header to cross-origin redirect targetsmsrc
- mediumCVE-2026-48860: Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in in…msrc
- mediumCVE-2026-48855: SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configuredmsrc
Recent advisories for Erlang/OTP
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Erlang/OTP: Multiple vulnerabilitiescert-bund · 2026-07-31
- unknownCVE-2026-59251: Allocation of resources without limits in Erlang/OTP public_key certificate path validation al…nvd · 2026-07-27
- unknownCVE-2026-59250: Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthe…nvd · 2026-07-27
- unknownCVE-2026-58227: The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer c…nvd · 2026-07-27
- unknownCVE-2026-55953: The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite…nvd · 2026-07-27
- unknownCVE-2026-54890: Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), …nvd · 2026-07-27
More from CERT-Bund (BSI) Security Advisories
- high[NEU] [hoch] rclone: Mehrere Schwachstellen2026-08-03
- high[NEU] [hoch] Bouncy Castle: Mehrere Schwachstellen2026-08-03
- medium[NEU] [mittel] N-able N-Central: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen2026-08-03
- high[NEU] [hoch] IBM Langflow Desktop: Mehrere Schwachstellen2026-08-03
- high[NEU] [hoch] Wazuh: Mehrere Schwachstellen2026-08-03