Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-89422 | Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-68956 | Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory b | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-65634 | Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of servi | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-74994 | The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blo | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-47078 | Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-55952 | The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-55950 | Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacke | erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-54891 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-54887 | Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-54886 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-53422 | Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of fi | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-49760 | Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with pr | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-49759 | Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a c | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-48860 | Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-ov | erlang erlang erlang erlang |
| CVE | CVE-2026-48858 | Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV r | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-48856 | Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-48855 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_REA | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-42791 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired respo | erlang erlang erlang erlang |
| CVE | CVE-2026-42790 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via s | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-42789 | Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be ac | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
About
-
Send Feedback to @ubuntu_updates
