Debian Patches

Status for erlang/1:27.3.4.1+dfsg-1+deb13u3

Patch Description Author Forwarded Bugs Origin Last update
CVE-2026-59251.patch Merge branch 'kuba/maint-27/public_key/policy_tree_exhaustion_fix/OTP-20251' into maint-27

* kuba/maint-27/public_key/policy_tree_exhaustion_fix/OTP-20251:
public_key: Cap policy tree growth to prevent DoS

(cherry picked from commit d221f88880bdf458c008e716c616c76f8425d984)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
clean.patch clean.patch by Sergei Golovan <sgolovan@nes.ru>

Erlang leaves many files after make clean. This patch contains
a hack to remove them.		 no
gnu.patch (1) Defines GNU macros not only for Linux but also for any system
with 'gnu' substring in OS name. Fixes FTBFS on GNU/kFreeBSD and GNU/Hurd.

(2) Undefines BSD4_4 for os_mon application for GNU/Hurd;

(3) Undefines AF_LINK for GNU/Hurd;

(4) Switches some PATH_MAX occurrences to MAXPATHLEN;

(5) Adds a workaround for 'erlc -M | sed' being stuck for GNU/Hurd.		 Pino Toscano <pino@debian.org> no
javascript.patch Patch drops JavaScript libraries from the binary package. Sergei Golovan no
x32.patch This patch fixes FTBFS for x86_x32 architecture (x86_64 with 32-bit integers, longs and pointers). Sergei Golovan no
doc.patch Patch moves the command line syntax to a separate ``` block, and fixes interpreting | as table column separators. Sergei Golovan no
exdoc.patch Patch fixes FTBFS when using pbuilder. Sergei Golovan no
CVE-2016-1000107.patch A mix of patches to fix CVE-2016-1000107 and to test for it. Upstream (Marcel Lanz <marcellanz@n-1.ch> and Konrad Pietrzak <konrad@erlang.org>) yes debian upstream 2025-09-18
CVE-2025-48038.patch ssh: verify file handle size limit for client data - reject handles exceeding 256 bytes (as specified for SFTP)
- fixes CVE-2025-48038		 Upstream (Jakub Witczak <kuba@erlang.org>) no 2025-08-27
CVE-2025-48039.patch ssh: ssh_sftpd verify path size for client data - reject max_path exceeding the 4096 limit or according to other option value
- fix CVE-2025-48039		 Upstream (Jakub Witczak <kuba@erlang.org>) no 2025-07-11
CVE-2025-48040.patch ssh: key exchange robustness improvements
- reduce untrusted data processing for non-debug logs
- trim badmatch exceptions to avoid processing potentially malicious data
- terminate with kexinit_error when too many algorithms are received in KEX init message		 Jakub Witczak <kuba@erlang.org> no backport, https://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a 2025-08-20
CVE-2025-48041.patch ssh: max_handles option added to ssh_sftpd
- add max_handles option and update tests (1000 by default)
- remove sshd_read_file redundant testcase		 Jakub Witczak <kuba@erlang.org> no backport, https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288 2025-08-20
CVE-2026-21620.patch Merge branch 'raimo/tftp/path-traversal-27/OTP-19981' into maint-27
* raimo/tftp/path-traversal-27/OTP-19981:
Fix typos
Fix old timing sensitive test case
Document security considerations
Fix old timing sensitive test case
Test option root_dir
Rewrite old style catch
Validate initial options


More info about this CVE: https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp		 Erlang/OTP <otp@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e 2026-02-19
CVE-2026-23941.patch Merge branch 'whaileee/inets/httpd/http-request-smuggling/OTP-20007' into maint-27

* whaileee/inets/httpd/http-request-smuggling/OTP-20007:
Prevent httpd from parsing HTTP requests when multiple Content-Length headers are present		 Erlang/OTP <otp@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b 2026-03-12
CVE-2026-23942.patch Merge branch 'kuba/maint-27/ssh/sftp_path/OTP-20009' into maint-27
* kuba/maint-27/ssh/sftp_path/OTP-20009:
ssh: Fix path traversal vulnerability in ssh_sftpd root directory validation		 Erlang/OTP <otp@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28 2026-03-12
CVE-2026-23943.patch Merge branch 'michal/maint-27/ssh/fix-unbounded-zlib-inflate/OTP-20011' into maint-27

* michal/maint-27/ssh/fix-unbounded-zlib-inflate/OTP-20011:
Add test for post-authentication compression
Add information about compression-based attacks to hardening guide
Adjust documentation to mention that zlib is disabled by default
Add tests that verify we disconnect on too large decompressed data
Always run compression test
Disable zlib by default and limit size of decompressed data		 Erlang/OTP <otp@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3 2026-03-12
CVE-2026-28810.patch Merge branch 'raimo/kernel/inet_res-id-27/OTP-20037' into maint-27

* raimo/kernel/inet_res-id-27/OTP-20037:
Update after feedback
Revert "Avoid duplicate DNS transaction IDs"
Avoid duplicate DNS transaction IDs
Randomize `inet_res` transaction ID and source port number

# Conflicts:
# lib/kernel/src/inet.erl

(cherry picked from commit f01d4e32e439ebef774dee0efe7a4c9a0bd36dca)		 Erlang/OTP <otp@erlang.org> no 2026-04-07
CVE-2026-28808.patch Merge branch 'whaileee/inets/httpd/cgi-auth-skip/OTP-20068' into maint-27

* whaileee/inets/httpd/cgi-auth-skip/OTP-20068:
inets: Check script_alias when using mod_auth

(cherry picked from commit 2f3cd39a634148472fdf89e31b16bd6a7459633c)		 Erlang/OTP <otp@erlang.org> no 2026-04-07
CVE-2026-32144-1.patch Merge branch 'kuba/maint-27/public_key/ocsp_responder_fix/OTP-20042' into maint-27

* kuba/maint-27/public_key/ocsp_responder_fix/OTP-20042:
public_key: Verify designated OCSP responder certificate signature

(cherry picked from commit 0585bde5255272250fdf1f69753d69a819ebc60f)		 Erlang/OTP <otp@erlang.org> no 2026-04-07
CVE-2026-32144-2.patch Merge branch 'kuba/maint-27/ssl/stapling_hard_fail/OTP-20064' into maint-27

* kuba/maint-27/ssl/stapling_hard_fail/OTP-20064:
ssl: Hard-fail on missing OCSP staple when stapling is configured

(cherry picked from commit 8b8bbd22fd97972bf0bf1373a3d3c67bf224c08f)

Debian note: the hunk touching lib/ssl/src/ssl.app.src is dropped. In upstream
git that runtime_dependencies entry is the unsubstituted placeholder
"public_key-@OTP-NNNNN@", which upstream's release process resolves before the
tarball is rolled; the released 27.3.4.1 tarball already carries the literal
"public_key-1.16.4". Applying it here would write an unresolved placeholder
into the shipped ssl.app.		 Erlang/OTP <otp@erlang.org> no 2026-04-07
CVE-2026-32147.patch Merge branch 'michal/ssh/fix-access-attributes-outside-root/OTP-20081' into maint-27

* michal/ssh/fix-access-attributes-outside-root/OTP-20081:
Add ssh keys for sftpd_SUITE
Add license header
Remove comments when installing ssh keys
Fix root escape vulnerability in SSH_FXP_FSETSTAT

# Conflicts:
# lib/ssh/src/ssh_sftpd.erl
# lib/ssh/test/ssh_sftpd_SUITE.erl
# lib/ssh/test/ssh_test_lib.erl

(cherry picked from commit ee89ffc95cf8855be030abb83be19e1e889d99e5)

Debian note: this commit extends the -export list of
lib/ssh/test/ssh_test_lib.erl, and conflicts here. Upstream's version of that
list also exports server_host/1, server_port/1, server_pid/1, system_dir/1,
user_dir/1 and get_public_key_algorithms_with_valid_host_key/1,2, whose
definitions arrive in other, non-security commits that are not backported.
Exporting them makes the module fail to compile ("function server_host/1
undefined") and aborts the whole ssh test run; nothing in this tree calls them.
The conflict is resolved by keeping only the entries whose functions exist:
event_logged/3 and remove_comment/1.		 Erlang/OTP <otp@erlang.org> no 2026-04-20
CVE-2026-42789.patch Merge branch 'ingela/public_key/basic_constraint/OTP-20129' into maint-27

* ingela/public_key/basic_constraint/OTP-20129:
public_key: Update to stricter check as clearly defined in RFC 5280

(cherry picked from commit f90ae41645001680404a2011f0baf900871a5409)		 Erlang/OTP <otp@erlang.org> no 2026-05-26
CVE-2026-42790.patch Merge branch 'ingela/maint-27/ssl/public_key/hostname-check-fallback/OTP-20130' into
maint-27

* ingela/maint-27/ssl/public_key/hostname-check-fallback/OTP-20130:
ssl: Improve error handling due to public_key updates.
public_key: Add new error
public_key: Adhere to RFC 9525

# Conflicts:
# lib/ssl/src/ssl.app.src

(cherry picked from commit cf547030c1e93290decf093d0338f342eb99d9e4)

Debian note: the hunk touching lib/ssl/src/ssl.app.src is dropped. In upstream
git that runtime_dependencies entry is the unsubstituted placeholder
"public_key-@OTP-NNNNN@", which upstream's release process resolves before the
tarball is rolled; the released 27.3.4.1 tarball already carries the literal
"public_key-1.16.4". Applying it here would write an unresolved placeholder
into the shipped ssl.app.		 Erlang/OTP <otp@erlang.org> no 2026-05-26
CVE-2026-42791.patch Merge branch 'kuba/maint-27/public_key/ocsp_responder_validity_period_fix/OTP-20112' into
maint-27

* kuba/maint-27/public_key/ocsp_responder_validity_period_fix/OTP-20112:
public_key: Validate OCSP responder certificate validity period

(cherry picked from commit 5c0314c80d9e17b57fb378560ecb75fb38b321ac)		 Erlang/OTP <otp@erlang.org> no 2026-05-26
CVE-2026-48860.patch Merge branch 'ingela/ssl-dist/OTP-20156' into maint-27
* ingela/ssl-dist/OTP-20156:
ssl: Correct function used to check peer IP

(cherry picked from commit f9bf5cfaad90afe100390c148be0711032b77a8b)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-48858.patch Merge branch 'ingela/maint-27/ftp/PASV/OTP-20166' into maint-27

* ingela/maint-27/ftp/PASV/OTP-20166:
ftp: validate PASV response IP against control connection peer

(cherry picked from commit 94686b01d4d3369d5b9f9e33f0433fbe79889a1c)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-49759.patch Merge branch 'raimo/erts/inet_drv-sctp-error-oob/OTP-20165' into maint-27

* raimo/erts/inet_drv-sctp-error-oob/OTP-20165:
Rewrite error parse loop to handle all lengths
Protect the output term buffer from overflow

(cherry picked from commit cc60fddc5bbb6ff0261754ae3da84fda86e1ef62)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-48855.patch Merge branch 'michal/ssh/fix-sftp-readlink-abs-path-leak/OTP-20162' into maint-27

* michal/ssh/fix-sftp-readlink-abs-path-leak/OTP-20162:
Fix absolute path leak from SSH_FXP_READLINK
Strip comments when installing ssh keys
Add information about symlinks to hardening guide
Add ssh keys and license headers for ssh_sftpd_SUITE

# Conflicts:
# lib/ssh/test/ssh_test_lib.erl

(cherry picked from commit d25347ce870223f0b27170c8fd90584817c6dedf)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-48856.patch Merge branch 'whaileee/httpc/auth-headers-forward-on-cross-origin/OTP-20155' into maint-27

* whaileee/httpc/auth-headers-forward-on-cross-origin/OTP-20155:
inets/httpc: strip sensitive headers on cross-origin redirect

(cherry picked from commit a446753217488efa1a44854a339c1a6472ab0646)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-49760.patch Merge branch 'sverker/erl_interface/big-print-overflow/OTP-20160' into maint-27

* sverker/erl_interface/big-print-overflow/OTP-20160:
erl_interface: Fix stack overflow in ei_s_print_term

(cherry picked from commit 1465a643370c013137b9ddcf04240fcc67a478f5)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-54887.patch Merge branch 'ingela/ssl/dtls-cookie/OTP-20194' into maint-27
* ingela/ssl/dtls-cookie/OTP-20194:
ssl: Avoid cookie forgery during setup up window

(cherry picked from commit 07bf2a96099e84fe06e9ae1c6d5f2fee97311938)		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-54891.patch Merge branch 'ingela/ssl/client-guards/OTP-20207' into maint-27

* ingela/ssl/client-guards/OTP-20207:
ssl: Refactor to keep state specific handling in state functions
ssl: TLS Client hardening

(cherry picked from commit e07c1ba604856a994b533a5f3ed84e9463f06ebc)		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-55952.patch ssl: Add PSK parameter check
(cherry picked from commit 9b5437c72fa3403a75c1aba28e5c532bc191c662)		 Ingela Anderton Andin <ingela@erlang.org> no 2026-06-23
CVE-2026-55950.patch Merge branch 'ingela/dtls/OTP-20220' into maint-27
* ingela/dtls/OTP-20220:
ssl: Fix DTLS race condition

(cherry picked from commit e9b49dd8029f096c6c7091fd6c6b43f592b8a14a)		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-53422.patch Merge branch 'michal/maint-27/ssh/fix-sftp-realpath-filesystem-enumeration/OTP-20183' into
maint-27

* michal/maint-27/ssh/fix-sftp-realpath-filesystem-enumeration/OTP-20183:
Fix realpath path existence oracle

(cherry picked from commit de8731f637e2976af210f0ad277490e4f14321c9)

Debian note: conflicts in lib/ssh/src/ssh_sftpd.erl only because upstream
reindented the SSH_FXP_REALPATH clause and renamed Rlen to RLen in a commit
that is not backported. The conflict is resolved by keeping this tree's
formatting and variable name; the functional change is upstream's.		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-54886.patch Merge branch 'michal/ssh/fix-sftp-extended-data-infinite-loop/OTP-20186' into maint-27

* michal/ssh/fix-sftp-extended-data-infinite-loop/OTP-20186:
Fix extended data infinite loop in sftpd
Strip comments when installing ssh keys
Add ssh keys and license headers for ssh_sftpd_SUITE

# Conflicts:
# lib/ssh/test/ssh_sftpd_SUITE.erl
# lib/ssh/test/ssh_test_lib.erl

(cherry picked from commit 4e0bd6ba012010765660372d81be45f7aadc9ecb)		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-55737.patch Merge branch 'kiko/erts/fixes-heap-pointer-signed-unsigned/OTP-20214' into maint-27

* kiko/erts/fixes-heap-pointer-signed-unsigned/OTP-20214:
erts: Fixes heap pointer corruption via signed/unsigned mismatch

(cherry picked from commit 2b18cb1d0b139d9f24667c9b5b92a4fc13b7004e)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-55953.patch Merge branch 'ingela/maint-27/ssl/pre-13-client-cipher-suite-validation/OTP-20240' into
maint-27

* ingela/maint-27/ssl/pre-13-client-cipher-suite-validation/OTP-20240:
ssl: Add test that client rejects unofferd algorithms
ssl: Add pre TLS-1.3 client alpn check
ssl: Add pre TLS-1.3 client cipher suite check

(cherry picked from commit 1213c752de9f39501faeefaf5d67c70255ad194d)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-58227.patch Merge branch 'ingela/maint-27/ssl/cert-chain/OTP-20245' into maint-27

* ingela/maint-27/ssl/cert-chain/OTP-20245:
ssl: Use digraph to ensure robust cert chain building.

(cherry picked from commit e365625d8c2bc1ce05d393b98185f22243cbd3ad)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-59250.patch Merge branch 'kuba/megaco/sprintf-overflow/OTP-20237' into maint-27

* kuba/megaco/sprintf-overflow/OTP-20237:
megaco: fix sprintf buffer overflow in flex scanner

(cherry picked from commit ea39889874a2a3c65ce91e3a3d90b318d44a2765)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-47078.patch Merge branch 'john/stdlib/GHSA-rf72-wp7h-jg3x/OTP-20143' into maint-27

* john/stdlib/GHSA-rf72-wp7h-jg3x/OTP-20143:
zip: Fix relative path traversal checking

(cherry picked from commit 3c629528a5e279532fd56a79d49094dddd064f52)

Debian note: the deletion of the binary test fixture
lib/stdlib/test/zip_SUITE_data/exploit.zip is dropped, because a quilt patch
cannot represent a binary file change. The rewritten test builds the archive
at runtime with zip:create/3 in priv_dir, so the stale fixture is simply left
in place, unreferenced.		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-42792-1.patch epmd: Don't clobber errno on dbg_perror
(cherry picked from commit d5598dbaea92c14d4e421898a6886ef31b63a175)		 John Högberg <john@erlang.org> no 2026-05-13
CVE-2026-42792-2.patch epmd: Improve slow-connection handling
(cherry picked from commit 865d203e4a6a8f44179eced9e1428f9259e4a3bb)		 John Högberg <john@erlang.org> no 2026-05-08
CVE-2026-54890.patch Merge branch 'john/erts/GHSA-54pw-5645-jh86/OTP-20259' into maint-27

* john/erts/GHSA-54pw-5645-jh86/OTP-20259:
erts: Fix crash on decoding invalid ETF terms

(cherry picked from commit c76f0dabbb0356f0f067a8773143dd4b76c6ca70)		 Erlang/OTP <otp@erlang.org> no 2026-07-24

All known versions for source package 'erlang'

Links