Erlang security advisory (AV26-948)
Canadian Cyber Centre warns Erlang/OTP is affected by CVE-2026-65634 and CVE-2026-89422 and urges updates.
The Canadian Centre for Cyber Security published advisory AV26-948 stating that Erlang/OTP is affected by vulnerabilities tracked as CVE-2026-65634 and CVE-2026-89422. The notice lists multiple OTP release lines and commits that are fixed only in later builds, including 27.3.4.18, 28.5.0.7, and 29.1.1. Administrators are urged to review the linked erlang/otp GitHub security advisories and apply updates. No exploitation is described.
- Advisory AV26-948, dated September 22, 2026, covers Erlang/OTP.
- Cited identifiers are CVE-2026-65634 and CVE-2026-89422.
- Users are told to review the GitHub advisories and apply updates.
- The notice does not report active exploitation.
- Products
- Erlang/OTP
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65634 | Unauthenticated DoS in Erlang/OTP asn1 OBJECT IDENTIFIER Decoder (CVE-2026-65634) | 8.2 | — | ||
| CVE-2026-89422 | Key Exchange Impersonation in Erlang/OTP ssl (CVE-2026-89422) | 9.3 | — |
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-948 Date: September 22, 2026 As of September 22, 2026, Erlang is affected by vulnerabilities in the following product: OTP 17. 0 Prior to 27. 3.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.