OTP updates address http and integer vulnerabilities
Remedies for http client and server bugs, integer serialization DoS
Today Erlang/OTP released the following versions to address vulnerabilities described below:
Two themes
The remedies follow two themes:
- http client and server updates
- 12 related CVEs
- Lukas Backström did an audit, discovering many of them and also fixed other non-vulnerability bugs
- Integer DOS CVEs
- parsing, serialization
Notable background
After the issuance of CVE-2026-49762 and the GitHub Security Advisory dealing with integer serialization in Elixir, a more general discussion was started after realizing this is a common issue.
The discussion proceeded with participants from across the ecosystem to consider solutions.
Integer handling in Erlang is seamless to users and yet provides nearly unbounded number scaling. However, handling of large integers (larger than 10100,000), especially during serialization, is multiplication expensive since base-10 string digits must be converted to base-2 to become an erlang integer. This cost becomes a vulnerability when serializing untrusted integer string input.
One approach considered was to alter the way scaling behaviour of integers at a low level. But this would be a breaking change and was deemed as destabilizing. These current OTP releases take a more detailed, non-breaking approach to this class of problem, not impacting existing software or practices.
Implications
If you are writing or maintaining code that is parsing integers, this topic important to consider. If you have questions regarding impact or approaches please contact the CNA