An update of the erlang package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20607-1 advisory.

    Security issues fixed:

    - CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and     remote       arbitrary reads/writes (bsc#1258663).
    - CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP     request       smuggling (bsc#1259687).
    - CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead     to path       traversal (bsc#1259681).
    - CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of     service       (bsc#1259682).
    - CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts     (bsc#1261728).
    - CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).
    - CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information     disclosure       (bsc#1261734).

    Other updates and bugfixes:

    - jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6464 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6464-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 25, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : erlang     CVE ID         : CVE-2026-28808 CVE-2026-28810 CVE-2026-32144 CVE-2026-32147                      CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792                      CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858                      CVE-2026-48860 CVE-2026-49759 CVE-2026-49760 CVE-2026-53422                      CVE-2026-54886 CVE-2026-54887 CVE-2026-54890 CVE-2026-54891                      CVE-2026-55737 CVE-2026-55950 CVE-2026-55952 CVE-2026-55953                      CVE-2026-58227 CVE-2026-59250 CVE-2026-59251     Debian Bug     : 1139727 1139823 1141414 1142985

    Multiple vulnerabilities were discovered in Erlang/OTP, a concurrent,     real-time, distributed functional language, which may result in denial of     service, information disclosure, authentication and certificate validation     bypass, or the execution of arbitrary code. These vulnerbilities affect a     wide range of components: TLS and certificate validation (ssl, public_key),     SSH (ssh), network clients and servers (inets, ftp, epmd, kernel),     runtime and libraries (erts, erl_interface, stdlib, megaco).

    Several of these fixes tighten checks that were previously too permissive,     and can cause configurations that worked before to stop working. The most     likely to be noticed are:

     - TLS clients using verify_peer, which is the default, now reject        certificates that carry no subjectAltName extension; the        customize_hostname_check option does not restore the old behaviour.

     - Erlang distribution over TLS with the kernel 'check_ip' option now        enforces the check that was previously a no-op, so clusters whose nodes        are not on the same subnet lose distribution connectivity until the        option is unset.

     - TLS clients that request OCSP stapling now fail the handshake when the        server provides no stapled response.

     - Clients using TLS 1.2 or earlier now abort the handshake if the server        sends an ALPN extension that the client did not advertise.

     - DNS queries made through inet_res now use randomised source ports

    For the stable distribution (trixie), these problems have been fixed in     version 1:27.3.4.1+dfsg-1+deb13u3.

    We recommend that you upgrade your erlang packages.

    For the detailed security status of erlang please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/erlang

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Erlang/OTP installed on the remote host is 27.x prior to 27.3.4.10 or 28.x prior to 28.4.2. It is, therefore, affected by a certificate validation bypass vulnerability:

  - Improper certificate validation in the public_key application's OCSP response validation allows an attacker who     can intercept or control OCSP responses to forge responses that mark revoked certificates as valid. The OCSP     response validation does not verify that a CA-designated responder certificate was cryptographically signed by     the issuing CA, only checking the responder certificate's issuer name and OCSPSigning extended key usage.
    (CVE-2026-32144)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP     designated-responder authorization bypass via missing signature verification. The OCSP response validation     in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was     cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's     issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage.
    An attacker who can intercept or control OCSP responses can create a self-signed certificate with a     matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked     certificates as valid. This affects SSL/TLS clients using OCSP stapling, which may accept connections to     servers with revoked certificates, potentially transmitting sensitive data to compromised servers.
    Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact     depending on usage context. This vulnerability is associated with program files     lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3. This issue     affects OTP from OTP 27.0 before OTP 28.4.2 and OTP 27.3.4.10, corresponding to public_key from 1.16     before 1.20.3 and 1.17.1.2, and ssl from 11.2 before 11.5.4 and 11.2.12.7. (CVE-2026-32144)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
312353	Photon OS 5.0: Erlang PHSA-2026-5.0-0831	Nessus	PhotonOS Local Security Checks	5/6/2026	5/6/2026	high
332282	Photon OS 5.0: Erlang PHSA-2026-5.0-91-0831	Nessus	PhotonOS Local Security Checks	8/5/2026	8/5/2026	high
310082	openSUSE 16 Security Update : erlang (openSUSE-SU-2026:20607-1)	Nessus	SuSE Local Security Checks	4/24/2026	4/24/2026	high
312351	Photon OS 4.0: Erlang PHSA-2026-4.0-1005	Nessus	PhotonOS Local Security Checks	5/6/2026	5/6/2026	high
339216	Debian dsa-6464 : erlang - security update	Nessus	Debian Local Security Checks	8/25/2026	8/25/2026	critical
305687	Erlang/OTP 27.x < 27.3.4.10 / 28.x < 28.4.2 OCSP Certificate Validation Bypass (CVE-2026-32144)	Nessus	Misc.	4/9/2026	4/27/2026	high
305609	Linux Distros Unpatched Vulnerability : CVE-2026-32144	Nessus	Misc.	4/8/2026	8/25/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

critical

high

high