New OTP Releases Resolve 8 CVEs

Published on Jul 27, 2026

The Erlang/OTP Team just published releases that include security fixes for 8 CVEs.

The CVEs addressed include:

BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
- CVE-2026-54890
Denial of service via exponential certificate policy tree growth in path validation
- CVE-2026-59251
Megaco flex scanner buffer overflow via oversized property parm name
- CVE-2026-59250
TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
- CVE-2026-55953
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
- CVE-2026-55737
Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
- CVE-2026-47078
epmd permanent DoS via EMFILE on accept(2) in erts
- CVE-2026-42792
TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
- CVE-2026-58227