UbuntuUpdates.org

Package "erlang-dev"

Name: erlang-dev

Description:

Erlang/OTP development libraries and headers
Latest version: 1:24.2.1+dfsg-1ubuntu0.7
Release: jammy (22.04)
Level: security
Repository: main
Head package: erlang
Homepage: http://www.erlang.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "erlang-dev"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "erlang-dev" in Jammy

Repository Area Version
base main 1:24.2.1+dfsg-1
updates main 1:24.2.1+dfsg-1ubuntu0.7

Changelog

Version: 1:24.2.1+dfsg-1ubuntu0.7 2026-09-28 02:07:19 UTC

erlang (1:24.2.1+dfsg-1ubuntu0.7) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service in the Erlang Port Mapper Daemon
    - debian/patches/CVE-2026-42792.patch: epmd: Improve slow-connection
      handling in erts/epmd/src/epmd_srv.c.
    - CVE-2026-42792
  * SECURITY UPDATE: buffer overflow via crafted packet length
    - debian/patches/CVE-2026-75538.patch: Avoid signed int overflows in
      erts/emulator/beam/packet_parser.c,
      erts/emulator/drivers/common/inet_drv.c.
    - CVE-2026-75538
  * SECURITY UPDATE: buffer overflow in the megaco flex scanner
    - debian/patches/CVE-2026-59250.patch: megaco: fix sprintf buffer overflow
      in flex scanner in lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src.
    - CVE-2026-59250
  * SECURITY UPDATE: TLS clients accepted cipher suites they did not offer
    - debian/patches/CVE-2026-55953.patch: ssl: Add pre TLS-1.3 client cipher
      suite check in lib/ssl/src/ssl_handshake.erl.
    - CVE-2026-55953
  * SECURITY UPDATE: denial of service via crafted certificate chains
    - debian/patches/CVE-2026-58227.patch: ssl: Use digraph to ensure robust
      cert chain building. in lib/ssl/src/ssl_certificate.erl,
      lib/ssl/test/ssl_cert_SUITE.erl.
    - CVE-2026-58227
  * SECURITY UPDATE: HTTP request smuggling via conflicting framing headers
    - debian/patches/CVE-2026-73812-pre1.patch: Prevent httpd from parsing HTTP
      requests when multiple Content-Length headers are present in
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/src/http_server/httpd_request_handler.erl,
      lib/inets/test/httpd_SUITE.erl.
    - debian/patches/CVE-2026-73812.patch: inets: Reject requests with both
      Transfer-Encoding and Content-Length in
      lib/inets/src/http_server/httpd_internal.hrl,
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/test/http_test_lib.erl, lib/inets/test/httpc_SUITE.erl.
    - CVE-2026-23941
    - CVE-2026-73812
  * SECURITY UPDATE: denial of service via malformed chunk sizes
    - debian/patches/CVE-2026-69664.patch: inets: Fix rejection of invalid chunk
      sizes in lib/inets/src/http_server/httpd_request_handler.erl,
      lib/inets/test/httpd_SUITE.erl.
    - CVE-2026-69664
  * SECURITY UPDATE: denial of service via unbounded chunked request bodies
    - debian/patches/CVE-2026-74835.patch: inets: Fix max_body_size to apply to
      chunks as we receive them in lib/inets/src/http_lib/http_chunk.erl,
      lib/inets/src/http_server/httpd_request_handler.erl,
      lib/inets/test/http_format_SUITE.erl.
    - CVE-2026-74835
  * SECURITY UPDATE: authentication bypass via path equivalence / authentication bypass via inconsistent case handling
    - debian/patches/CVE-2026-66835_73270.patch: inets: Canonicalize request
      path before mod_auth directory check in
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/src/http_server/httpd_util.erl,
      lib/inets/src/http_server/mod_alias.erl,
      lib/inets/src/http_server/mod_auth.erl.
    - CVE-2026-66835
    - CVE-2026-73270
  * SECURITY UPDATE: denial of service via unlimited simultaneous connections
    - debian/patches/CVE-2026-70399.patch: inets: Fix default max_clients in
      lib/inets/src/http_lib/http_internal.hrl,
      lib/inets/src/http_server/httpd_manager.erl.
    - CVE-2026-70399
  * SECURITY UPDATE: HTTP request smuggling via header continuation lines
    - debian/patches/CVE-2026-66357.patch: inets: Reject obs-fold header
      continuation in httpd (RFC 9112) in
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/test/httpd_SUITE.erl.
    - CVE-2026-66357
  * SECURITY UPDATE: HTTP request smuggling via malformed header names
    - debian/patches/CVE-2026-73276.patch: inets: Reject headers with whitespace
      before colon in httpd in lib/inets/src/http_lib/http_request.erl,
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/test/httpd_SUITE.erl.
    - debian/patches/CVE-2026-73276-2.patch: httpd: add error handling for
      headers with whitespace before colon in
      lib/inets/src/http_lib/http_request.erl,
      lib/inets/src/http_server/httpd_internal.hrl,
      lib/inets/src/http_server/httpd_request.erl.
    - CVE-2026-73276
  * SECURITY UPDATE: authentication bypass via inconsistent case handling
    - debian/patches/CVE-2026-73270-2.patch: inets: Add caseless matching to
      mod_security directory lookup in lib/inets/src/http_server/httpd_util.erl,
      lib/inets/src/http_server/mod_security.erl.
    - CVE-2026-73270
  * SECURITY UPDATE: denial of service via incomplete request bodies
    - debian/patches/CVE-2026-71380-pre1.patch: inets: Adjust keep_alive_timeout
      effective measurement in httpd in
      lib/inets/src/http_server/httpd_conf.erl,
      lib/inets/src/http_server/httpd_request_handler.erl.
    - debian/patches/CVE-2026-71380-pre2.patch: inets: Add httpd option
      max_body_read_timeout in lib/inets/src/http_lib/http_internal.hrl,
      lib/inets/src/http_server/httpd_conf.erl,
      lib/inets/src/http_server/httpd_request_handler.erl.
    - debian/patches/CVE-2026-71380-pre3.patch: inets: Send 408 when we hit
      min_bytes_per_second floor in
      lib/inets/src/http_server/httpd_request_handler.erl.
    - debian/patches/CVE-2026-71380.patch: inets: rename max_body_read_timeout
      option to request_timeout in lib/inets/src/http_lib/http_internal.hrl,
      lib/inets/src/http_server/httpd_conf.erl,
      lib/inets/src/http_server/httpd_request_handler.erl.
    - debian/patches/CVE-2026-71380-2.patch: Fix dialyzer errors in
      httpd_request_handler in
      lib/inets/src/http_server/httpd_request_handler.erl.
    - CVE-2026-71380
  * SECURITY UPDATE: denial of service via unbounded HTTP response headers
    - debian/patches/CVE-2026-55951-pre1.patch: OTP-19158 httpc enable options
      for async request in lib/inets/src/http_client/httpc.erl,
      lib/inets/src/http_client/httpc_handler.erl,
      lib/ine
Source diff to previous version
CVE-2026-42792 Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminat
CVE-2026-75538 An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet
CVE-2026-59250 Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and p
CVE-2026-55953 The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the su
CVE-2026-58227 The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl
CVE-2026-73812 httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 ide
CVE-2026-23941 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smugglin
CVE-2026-69664 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denia
CVE-2026-74835 The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 befor
CVE-2026-66835 Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory
CVE-2026-73270 Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_aut
CVE-2026-70399 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denia
CVE-2026-66357 httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet uncondition
CVE-2026-73276 Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP
CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denia
CVE-2026-55951 The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option de

Version: 1:24.2.1+dfsg-1ubuntu0.6 2025-10-21 20:07:28 UTC

  erlang (1:24.2.1+dfsg-1ubuntu0.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Increased resource consumption in the SSH module.
    - debian/patches/CVE-2025-48038.patch: Add handle_op for file handle length
      string exceeding 256 bytes in lib/ssh/src/ssh_sftpd.erl.
    - debian/patches/CVE-2025-48039.patch: Add max_path option and limits in
      lib/ssh/src/ssh_sftpd.erl.i
    - debian/patches/CVE-2025-48040-pre1.patch: Fix error by adding try catch
      in lib/ssh/src/ssh_transport.erl.
    - debian/patches/CVE-2025-48040.patch: Add max_log_len in
      lib/ssh/src/ssh_connection.erl. Add Class:Reason0:Stacktrace for decode
      failures in lib/ssh/src/ssh_connection_handler.erl. Add trim_reason and
      max_log_len in lib/ssh/src/ssh_lib.erl. Change decode_kex_init in
      lib/ssh/src/ssh_message.erl. Change kexinit_error and modify Msg in
      lib/ssh/src/ssh_transport.erl.
    - debian/patches/CVE-2025-48041.patch: Add max_handles option and limits in
      lib/ssh/src/ssh_sftpd.erl.
    - CVE-2025-48038
    - CVE-2025-48039
    - CVE-2025-48040
    - CVE-2025-48041

 -- Hlib Korzhynskyy <email address hidden> Fri, 17 Oct 2025 15:17:48 -0230
Source diff to previous version
CVE-2025-48038 Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Ex
CVE-2025-48039 Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Ex
CVE-2025-48040 Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is ass
CVE-2025-48041 Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This v

Version: 1:24.2.1+dfsg-1ubuntu0.5 2025-07-21 15:11:45 UTC

  erlang (1:24.2.1+dfsg-1ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: insufficient strict KEX handshake hardening measures
    - debian/patches/CVE-2025-46712-pre1.patch: postpone
      ssh_connection_handler init in
      lib/ssh/src/ssh_connection_handler.erl.
    - debian/patches/CVE-2025-46712-pre2.patch: implement KEX strict in
      lib/ssh/src/ssh.hrl, lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_fsm_kexinit.erl, lib/ssh/src/ssh_transport.erl,
      lib/ssh/src/ssh_transport.hrl, lib/ssh/test/ssh_protocol_SUITE.erl,
      lib/ssh/test/ssh_test_lib.erl, lib/ssh/test/ssh_to_openssh_SUITE.erl,
      lib/ssh/test/ssh_trpt_test_lib.erl.
    - debian/patches/CVE-2025-46712-1.patch: add KEX strict implementation
      fixes in lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_fsm_kexinit.erl, lib/ssh/src/ssh_transport.erl,
      lib/ssh/test/ssh_protocol_SUITE.erl,
      lib/ssh/test/ssh_trpt_test_lib.erl.
    - CVE-2025-46712
  * SECURITY UPDATE: path traversal and other issues in zip
    - debian/patches/CVE-2025-4748.patch: properly sanitize filenames when
      (un)zipping in lib/stdlib/src/zip.erl, lib/stdlib/test/zip_SUITE.erl.
    - CVE-2025-4748

 -- Marc Deslauriers <email address hidden> Thu, 10 Jul 2025 12:45:03 -0400
Source diff to previous version
CVE-2025-46712 Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and O
CVE-2025-4748 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Trav

Version: 1:24.2.1+dfsg-1ubuntu0.4 2025-04-18 14:08:58 UTC

  erlang (1:24.2.1+dfsg-1ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Unauthenticated Remote Code Execution in SSH
    - debian/patches/CVE-2025-32433.patch: disconnect when connection
      protocol message arrives when user is not authenticated for
      connection in lib/ssh/src/ssh_connection.erl,
      lib/ssh/test/ssh_protocol_SUITE.erl.
    - CVE-2025-32433

 -- Marc Deslauriers <email address hidden> Wed, 16 Apr 2025 14:23:11 -0400
Source diff to previous version
CVE-2025-32433 Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server ma

Version: 1:24.2.1+dfsg-1ubuntu0.3 2025-04-08 21:07:13 UTC

  erlang (1:24.2.1+dfsg-1ubuntu0.3) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2025-30211-pre1.patch: reduce log length.
    - debian/patches/CVE-2025-30211-1.patch: reduce log processing for
      plain connections.
    - debian/patches/CVE-2025-30211-2.patch: ignore too long names.
    - debian/patches/CVE-2025-30211-3.patch: use chars_limit for bad
      packets error messages.
    - debian/patches/CVE-2025-30211-4.patch: custom_kexinit test added.
    - CVE-2025-30211

 -- Fabian Toepfer <email address hidden> Wed, 02 Apr 2025 19:28:13 +0200
CVE-2025-30211 Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KE


About   -   Send Feedback to @ubuntu_updates