USN-8827-1: Erlang vulnerabilities
Ubuntu's USN-8827-1 addresses Erlang bugs that can crash the port mapper or runtime.
Ubuntu published USN-8827-1 for multiple Erlang denial-of-service flaws. CVE-2026-42792 is improper handling of slow connections by the Erlang Port Mapper Daemon, which a remote attacker could use to cause a denial of service. CVE-2026-55737 is heap corruption when processing certain external term format data, crashing Erlang on Ubuntu 24.04 LTS and 26.04 LTS only. A further invalid external-term handling bug can also crash Erlang; the notice is truncated before naming that issue, and no exploitation is reported.
- CVE-2026-42792 lets a remote attacker DoS the Erlang Port Mapper Daemon.
- CVE-2026-55737 heap-corrupts Erlang via external term data and can crash it.
- The heap-corruption flaw affects only Ubuntu 24.04 LTS and 26.04 LTS.
- A separate invalid term-format bug can also crash Erlang; its CVE is truncated.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-42792+1 related CVE | Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the… | 6.3 group max | <1% |
From the original article
It was discovered that the Erlang Port Mapper Daemon did not properly handle slow connections. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-42792) It was discovered that Erlang incorrectly handled certain external term format data, leading to heap corruption.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.