Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)". The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings). Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6464 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6464-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 25, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : erlang     CVE ID         : CVE-2026-28808 CVE-2026-28810 CVE-2026-32144 CVE-2026-32147                      CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792                      CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858                      CVE-2026-48860 CVE-2026-49759 CVE-2026-49760 CVE-2026-53422                      CVE-2026-54886 CVE-2026-54887 CVE-2026-54890 CVE-2026-54891                      CVE-2026-55737 CVE-2026-55950 CVE-2026-55952 CVE-2026-55953                      CVE-2026-58227 CVE-2026-59250 CVE-2026-59251     Debian Bug     : 1139727 1139823 1141414 1142985

    Multiple vulnerabilities were discovered in Erlang/OTP, a concurrent,     real-time, distributed functional language, which may result in denial of     service, information disclosure, authentication and certificate validation     bypass, or the execution of arbitrary code. These vulnerbilities affect a     wide range of components: TLS and certificate validation (ssl, public_key),     SSH (ssh), network clients and servers (inets, ftp, epmd, kernel),     runtime and libraries (erts, erl_interface, stdlib, megaco).

    Several of these fixes tighten checks that were previously too permissive,     and can cause configurations that worked before to stop working. The most     likely to be noticed are:

     - TLS clients using verify_peer, which is the default, now reject        certificates that carry no subjectAltName extension; the        customize_hostname_check option does not restore the old behaviour.

     - Erlang distribution over TLS with the kernel 'check_ip' option now        enforces the check that was previously a no-op, so clusters whose nodes        are not on the same subnet lose distribution connectivity until the        option is unset.

     - TLS clients that request OCSP stapling now fail the handshake when the        server provides no stapled response.

     - Clients using TLS 1.2 or earlier now abort the handshake if the server        sends an ALPN extension that the client did not advertise.

     - DNS queries made through inet_res now use randomised source ports

    For the stable distribution (trixie), these problems have been fixed in     version 1:27.3.4.1+dfsg-1+deb13u3.

    We recommend that you upgrade your erlang packages.

    For the detailed security status of erlang please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/erlang

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the erlang package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp     erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated     with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77)     handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits     fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer,     producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts     the entire node with a message such as Cannot allocate 2305843009213693951 bytes of memory (of type     binary). The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by     supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts     atom creation and does not perform structural validation of binary encodings). Any application that     decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang     distribution protocol also decodes incoming terms through the same code path, but distribution is expected     to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP     27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4,     16.4.0.4 and 15.2.7.11. (CVE-2026-54890)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 445dc6b9-89e1-11f1-b35c-4c526214c986 advisory.

    https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86 reports:
    A specially crafted External Term Format (ETF) payload of               merely 7 bytes triggers a crash in the BEAM virtual machine               when processed by binary_to_term/1,2. The BIT_BINARY_EXT tag               with specific parameters causes an unsigned integer underflow               during bitstring size calculation, resulting in an enormous               memory allocation attempt that immediately terminates the VM.
              This is a full system crash, not a recoverable process               exception: Erlang supervision mechanisms, the [safe] option               and standard error handling cannot prevent it.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
339216	Debian dsa-6464 : erlang - security update	Nessus	Debian Local Security Checks	Local	critical
338673	Photon OS 5.0: Erlang PHSA-2026-5.0-92-0958	Nessus	PhotonOS Local Security Checks	Local	critical
330383	Linux Distros Unpatched Vulnerability : CVE-2026-54890	Nessus	Misc.	Local	high
330273	FreeBSD : Erlang/OTP -- binary_to_term crash on crafted BIT_BINARY_EXT input (445dc6b9-89e1-11f1-b35c-4c526214c986)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2026-54890

high

Tenable Plugins

critical

critical

high

high