Debian Patches

Status for erlang/1:27.3.4.1+dfsg-1+deb13u4

Patch Description Author Forwarded Bugs Origin Last update
clean.patch clean.patch by Sergei Golovan <sgolovan@nes.ru>

Erlang leaves many files after make clean. This patch contains
a hack to remove them.		 no
gnu.patch (1) Defines GNU macros not only for Linux but also for any system
with 'gnu' substring in OS name. Fixes FTBFS on GNU/kFreeBSD and GNU/Hurd.

(2) Undefines BSD4_4 for os_mon application for GNU/Hurd;

(3) Undefines AF_LINK for GNU/Hurd;

(4) Switches some PATH_MAX occurrences to MAXPATHLEN;

(5) Adds a workaround for 'erlc -M | sed' being stuck for GNU/Hurd.		 Pino Toscano <pino@debian.org> no
javascript.patch Patch drops JavaScript libraries from the binary package. Sergei Golovan no
x32.patch This patch fixes FTBFS for x86_x32 architecture (x86_64 with 32-bit integers, longs and pointers). Sergei Golovan no
doc.patch Patch moves the command line syntax to a separate ``` block, and fixes interpreting | as table column separators. Sergei Golovan no
exdoc.patch Patch fixes FTBFS when using pbuilder. Sergei Golovan no
CVE-2016-1000107.patch A mix of patches to fix CVE-2016-1000107 and to test for it. Upstream (Marcel Lanz <marcellanz@n-1.ch> and Konrad Pietrzak <konrad@erlang.org>) yes debian upstream 2025-09-18
CVE-2025-48038.patch ssh: verify file handle size limit for client data - reject handles exceeding 256 bytes (as specified for SFTP)
- fixes CVE-2025-48038		 Upstream (Jakub Witczak <kuba@erlang.org>) no 2025-08-27
CVE-2025-48039.patch ssh: ssh_sftpd verify path size for client data - reject max_path exceeding the 4096 limit or according to other option value
- fix CVE-2025-48039		 Upstream (Jakub Witczak <kuba@erlang.org>) no 2025-07-11
CVE-2025-48040.patch ssh: key exchange robustness improvements
- reduce untrusted data processing for non-debug logs
- trim badmatch exceptions to avoid processing potentially malicious data
- terminate with kexinit_error when too many algorithms are received in KEX init message		 Jakub Witczak <kuba@erlang.org> no backport, https://github.com/erlang/otp/commit/7cd7abb7e19e16b027eaee6a54e1f6fbbe21181a 2025-08-20
CVE-2025-48041.patch ssh: max_handles option added to ssh_sftpd
- add max_handles option and update tests (1000 by default)
- remove sshd_read_file redundant testcase		 Jakub Witczak <kuba@erlang.org> no backport, https://github.com/erlang/otp/commit/5f9af63eec4657a37663828d206517828cb9f288 2025-08-20
CVE-2026-21620.patch Merge branch 'raimo/tftp/path-traversal-27/OTP-19981' into maint-27
* raimo/tftp/path-traversal-27/OTP-19981:
Fix typos
Fix old timing sensitive test case
Document security considerations
Fix old timing sensitive test case
Test option root_dir
Rewrite old style catch
Validate initial options


More info about this CVE: https://github.com/erlang/otp/security/advisories/GHSA-hmrc-prh3-rpvp		 Erlang/OTP <otp@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/3970738f687325138eb75f798054fa8960ac354e 2026-02-19
CVE-2026-23941.patch Merge branch 'whaileee/inets/httpd/http-request-smuggling/OTP-20007' into maint-27

* whaileee/inets/httpd/http-request-smuggling/OTP-20007:
Prevent httpd from parsing HTTP requests when multiple Content-Length headers are present		 Erlang/OTP <otp@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b 2026-03-12
CVE-2026-23942.patch Merge branch 'kuba/maint-27/ssh/sftp_path/OTP-20009' into maint-27
* kuba/maint-27/ssh/sftp_path/OTP-20009:
ssh: Fix path traversal vulnerability in ssh_sftpd root directory validation		 Erlang/OTP <otp@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/9e0ac85d3485e7898e0da88a14be0ee2310a3b28 2026-03-12
CVE-2026-23943.patch Merge branch 'michal/maint-27/ssh/fix-unbounded-zlib-inflate/OTP-20011' into maint-27

* michal/maint-27/ssh/fix-unbounded-zlib-inflate/OTP-20011:
Add test for post-authentication compression
Add information about compression-based attacks to hardening guide
Adjust documentation to mention that zlib is disabled by default
Add tests that verify we disconnect on too large decompressed data
Always run compression test
Disable zlib by default and limit size of decompressed data		 Erlang/OTP <otp@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/93073c3bd338c60cd2bae715ce6a1d4ffc1a8fd3 2026-03-12
CVE-2026-28810.patch Merge branch 'raimo/kernel/inet_res-id-27/OTP-20037' into maint-27

* raimo/kernel/inet_res-id-27/OTP-20037:
Update after feedback
Revert "Avoid duplicate DNS transaction IDs"
Avoid duplicate DNS transaction IDs
Randomize `inet_res` transaction ID and source port number

# Conflicts:
# lib/kernel/src/inet.erl

(cherry picked from commit f01d4e32e439ebef774dee0efe7a4c9a0bd36dca)		 Erlang/OTP <otp@erlang.org> no 2026-04-07
CVE-2026-28808.patch Merge branch 'whaileee/inets/httpd/cgi-auth-skip/OTP-20068' into maint-27

* whaileee/inets/httpd/cgi-auth-skip/OTP-20068:
inets: Check script_alias when using mod_auth

(cherry picked from commit 2f3cd39a634148472fdf89e31b16bd6a7459633c)		 Erlang/OTP <otp@erlang.org> no 2026-04-07
CVE-2026-32144-1.patch Merge branch 'kuba/maint-27/public_key/ocsp_responder_fix/OTP-20042' into maint-27

* kuba/maint-27/public_key/ocsp_responder_fix/OTP-20042:
public_key: Verify designated OCSP responder certificate signature

(cherry picked from commit 0585bde5255272250fdf1f69753d69a819ebc60f)		 Erlang/OTP <otp@erlang.org> no 2026-04-07
CVE-2026-32144-2.patch Merge branch 'kuba/maint-27/ssl/stapling_hard_fail/OTP-20064' into maint-27

* kuba/maint-27/ssl/stapling_hard_fail/OTP-20064:
ssl: Hard-fail on missing OCSP staple when stapling is configured

(cherry picked from commit 8b8bbd22fd97972bf0bf1373a3d3c67bf224c08f)

Debian note: the hunk touching lib/ssl/src/ssl.app.src is dropped. In upstream
git that runtime_dependencies entry is the unsubstituted placeholder
"public_key-@OTP-NNNNN@", which upstream's release process resolves before the
tarball is rolled; the released 27.3.4.1 tarball already carries the literal
"public_key-1.16.4". Applying it here would write an unresolved placeholder
into the shipped ssl.app.		 Erlang/OTP <otp@erlang.org> no 2026-04-07
CVE-2026-32147.patch Merge branch 'michal/ssh/fix-access-attributes-outside-root/OTP-20081' into maint-27

* michal/ssh/fix-access-attributes-outside-root/OTP-20081:
Add ssh keys for sftpd_SUITE
Add license header
Remove comments when installing ssh keys
Fix root escape vulnerability in SSH_FXP_FSETSTAT

# Conflicts:
# lib/ssh/src/ssh_sftpd.erl
# lib/ssh/test/ssh_sftpd_SUITE.erl
# lib/ssh/test/ssh_test_lib.erl

(cherry picked from commit ee89ffc95cf8855be030abb83be19e1e889d99e5)

Debian note: this commit extends the -export list of
lib/ssh/test/ssh_test_lib.erl, and conflicts here. Upstream's version of that
list also exports server_host/1, server_port/1, server_pid/1, system_dir/1,
user_dir/1 and get_public_key_algorithms_with_valid_host_key/1,2, whose
definitions arrive in other, non-security commits that are not backported.
Exporting them makes the module fail to compile ("function server_host/1
undefined") and aborts the whole ssh test run; nothing in this tree calls them.
The conflict is resolved by keeping only the entries whose functions exist:
event_logged/3 and remove_comment/1.		 Erlang/OTP <otp@erlang.org> no 2026-04-20
CVE-2026-42789.patch Merge branch 'ingela/public_key/basic_constraint/OTP-20129' into maint-27

* ingela/public_key/basic_constraint/OTP-20129:
public_key: Update to stricter check as clearly defined in RFC 5280

(cherry picked from commit f90ae41645001680404a2011f0baf900871a5409)		 Erlang/OTP <otp@erlang.org> no 2026-05-26
CVE-2026-42790.patch Merge branch 'ingela/maint-27/ssl/public_key/hostname-check-fallback/OTP-20130' into
maint-27

* ingela/maint-27/ssl/public_key/hostname-check-fallback/OTP-20130:
ssl: Improve error handling due to public_key updates.
public_key: Add new error
public_key: Adhere to RFC 9525

# Conflicts:
# lib/ssl/src/ssl.app.src

(cherry picked from commit cf547030c1e93290decf093d0338f342eb99d9e4)

Debian note: the hunk touching lib/ssl/src/ssl.app.src is dropped. In upstream
git that runtime_dependencies entry is the unsubstituted placeholder
"public_key-@OTP-NNNNN@", which upstream's release process resolves before the
tarball is rolled; the released 27.3.4.1 tarball already carries the literal
"public_key-1.16.4". Applying it here would write an unresolved placeholder
into the shipped ssl.app.		 Erlang/OTP <otp@erlang.org> no 2026-05-26
CVE-2026-42791.patch Merge branch 'kuba/maint-27/public_key/ocsp_responder_validity_period_fix/OTP-20112' into
maint-27

* kuba/maint-27/public_key/ocsp_responder_validity_period_fix/OTP-20112:
public_key: Validate OCSP responder certificate validity period

(cherry picked from commit 5c0314c80d9e17b57fb378560ecb75fb38b321ac)		 Erlang/OTP <otp@erlang.org> no 2026-05-26
CVE-2026-48860.patch Merge branch 'ingela/ssl-dist/OTP-20156' into maint-27
* ingela/ssl-dist/OTP-20156:
ssl: Correct function used to check peer IP

(cherry picked from commit f9bf5cfaad90afe100390c148be0711032b77a8b)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-48858.patch Merge branch 'ingela/maint-27/ftp/PASV/OTP-20166' into maint-27

* ingela/maint-27/ftp/PASV/OTP-20166:
ftp: validate PASV response IP against control connection peer

(cherry picked from commit 94686b01d4d3369d5b9f9e33f0433fbe79889a1c)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-49759.patch Merge branch 'raimo/erts/inet_drv-sctp-error-oob/OTP-20165' into maint-27

* raimo/erts/inet_drv-sctp-error-oob/OTP-20165:
Rewrite error parse loop to handle all lengths
Protect the output term buffer from overflow

(cherry picked from commit cc60fddc5bbb6ff0261754ae3da84fda86e1ef62)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-48855.patch Merge branch 'michal/ssh/fix-sftp-readlink-abs-path-leak/OTP-20162' into maint-27

* michal/ssh/fix-sftp-readlink-abs-path-leak/OTP-20162:
Fix absolute path leak from SSH_FXP_READLINK
Strip comments when installing ssh keys
Add information about symlinks to hardening guide
Add ssh keys and license headers for ssh_sftpd_SUITE

# Conflicts:
# lib/ssh/test/ssh_test_lib.erl

(cherry picked from commit d25347ce870223f0b27170c8fd90584817c6dedf)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-48856.patch Merge branch 'whaileee/httpc/auth-headers-forward-on-cross-origin/OTP-20155' into maint-27

* whaileee/httpc/auth-headers-forward-on-cross-origin/OTP-20155:
inets/httpc: strip sensitive headers on cross-origin redirect

(cherry picked from commit a446753217488efa1a44854a339c1a6472ab0646)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-49760.patch Merge branch 'sverker/erl_interface/big-print-overflow/OTP-20160' into maint-27

* sverker/erl_interface/big-print-overflow/OTP-20160:
erl_interface: Fix stack overflow in ei_s_print_term

(cherry picked from commit 1465a643370c013137b9ddcf04240fcc67a478f5)		 Erlang/OTP <otp@erlang.org> no 2026-06-09
CVE-2026-54887.patch Merge branch 'ingela/ssl/dtls-cookie/OTP-20194' into maint-27
* ingela/ssl/dtls-cookie/OTP-20194:
ssl: Avoid cookie forgery during setup up window

(cherry picked from commit 07bf2a96099e84fe06e9ae1c6d5f2fee97311938)		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-54891.patch Merge branch 'ingela/ssl/client-guards/OTP-20207' into maint-27

* ingela/ssl/client-guards/OTP-20207:
ssl: Refactor to keep state specific handling in state functions
ssl: TLS Client hardening

(cherry picked from commit e07c1ba604856a994b533a5f3ed84e9463f06ebc)		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-55952.patch ssl: Add PSK parameter check
(cherry picked from commit 9b5437c72fa3403a75c1aba28e5c532bc191c662)		 Ingela Anderton Andin <ingela@erlang.org> no 2026-06-23
CVE-2026-55950.patch Merge branch 'ingela/dtls/OTP-20220' into maint-27
* ingela/dtls/OTP-20220:
ssl: Fix DTLS race condition

(cherry picked from commit e9b49dd8029f096c6c7091fd6c6b43f592b8a14a)		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-53422.patch Merge branch 'michal/maint-27/ssh/fix-sftp-realpath-filesystem-enumeration/OTP-20183' into
maint-27

* michal/maint-27/ssh/fix-sftp-realpath-filesystem-enumeration/OTP-20183:
Fix realpath path existence oracle

(cherry picked from commit de8731f637e2976af210f0ad277490e4f14321c9)

Debian note: conflicts in lib/ssh/src/ssh_sftpd.erl only because upstream
reindented the SSH_FXP_REALPATH clause and renamed Rlen to RLen in a commit
that is not backported. The conflict is resolved by keeping this tree's
formatting and variable name; the functional change is upstream's.		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-54886.patch Merge branch 'michal/ssh/fix-sftp-extended-data-infinite-loop/OTP-20186' into maint-27

* michal/ssh/fix-sftp-extended-data-infinite-loop/OTP-20186:
Fix extended data infinite loop in sftpd
Strip comments when installing ssh keys
Add ssh keys and license headers for ssh_sftpd_SUITE

# Conflicts:
# lib/ssh/test/ssh_sftpd_SUITE.erl
# lib/ssh/test/ssh_test_lib.erl

(cherry picked from commit 4e0bd6ba012010765660372d81be45f7aadc9ecb)		 Erlang/OTP <otp@erlang.org> no 2026-07-02
CVE-2026-55737.patch Merge branch 'kiko/erts/fixes-heap-pointer-signed-unsigned/OTP-20214' into maint-27

* kiko/erts/fixes-heap-pointer-signed-unsigned/OTP-20214:
erts: Fixes heap pointer corruption via signed/unsigned mismatch

(cherry picked from commit 2b18cb1d0b139d9f24667c9b5b92a4fc13b7004e)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-55953.patch Merge branch 'ingela/maint-27/ssl/pre-13-client-cipher-suite-validation/OTP-20240' into
maint-27

* ingela/maint-27/ssl/pre-13-client-cipher-suite-validation/OTP-20240:
ssl: Add test that client rejects unofferd algorithms
ssl: Add pre TLS-1.3 client alpn check
ssl: Add pre TLS-1.3 client cipher suite check

(cherry picked from commit 1213c752de9f39501faeefaf5d67c70255ad194d)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-58227.patch Merge branch 'ingela/maint-27/ssl/cert-chain/OTP-20245' into maint-27

* ingela/maint-27/ssl/cert-chain/OTP-20245:
ssl: Use digraph to ensure robust cert chain building.

(cherry picked from commit e365625d8c2bc1ce05d393b98185f22243cbd3ad)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-59250.patch Merge branch 'kuba/megaco/sprintf-overflow/OTP-20237' into maint-27

* kuba/megaco/sprintf-overflow/OTP-20237:
megaco: fix sprintf buffer overflow in flex scanner

(cherry picked from commit ea39889874a2a3c65ce91e3a3d90b318d44a2765)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-47078.patch Merge branch 'john/stdlib/GHSA-rf72-wp7h-jg3x/OTP-20143' into maint-27

* john/stdlib/GHSA-rf72-wp7h-jg3x/OTP-20143:
zip: Fix relative path traversal checking

(cherry picked from commit 3c629528a5e279532fd56a79d49094dddd064f52)

Debian note: the deletion of the binary test fixture
lib/stdlib/test/zip_SUITE_data/exploit.zip is dropped, because a quilt patch
cannot represent a binary file change. The rewritten test builds the archive
at runtime with zip:create/3 in priv_dir, so the stale fixture is simply left
in place, unreferenced.		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-42792-1.patch epmd: Don't clobber errno on dbg_perror
(cherry picked from commit d5598dbaea92c14d4e421898a6886ef31b63a175)		 John Högberg <john@erlang.org> no 2026-05-13
CVE-2026-42792-2.patch epmd: Improve slow-connection handling
(cherry picked from commit 865d203e4a6a8f44179eced9e1428f9259e4a3bb)		 John Högberg <john@erlang.org> no 2026-05-08
CVE-2026-54890.patch Merge branch 'john/erts/GHSA-54pw-5645-jh86/OTP-20259' into maint-27

* john/erts/GHSA-54pw-5645-jh86/OTP-20259:
erts: Fix crash on decoding invalid ETF terms

(cherry picked from commit c76f0dabbb0356f0f067a8773143dd4b76c6ca70)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
CVE-2026-59251.patch Merge branch 'kuba/maint-27/public_key/policy_tree_exhaustion_fix/OTP-20251' into maint-27

* kuba/maint-27/public_key/policy_tree_exhaustion_fix/OTP-20251:
public_key: Cap policy tree growth to prevent DoS

(cherry picked from commit d221f88880bdf458c008e716c616c76f8425d984)		 Erlang/OTP <otp@erlang.org> no 2026-07-24
ssh-test-macros.patch Add ssh test macros needed by the backported CVE regression tests

The upstream security fixes backported here bring their own regression tests,
and those tests use test scaffolding that reached maint-27 in unrelated,
non-security commits which are deliberately not backported:

Without them ssh_sftpd_SUITE.erl fails to compile ("undefined macro
'CT_FAIL/2'", "undefined macro 'assertEqual/2'") and the whole ssh test run
aborts.

https://github.com/erlang/otp/commit/981a866ece347e8355da2a561280f7d3f07eab52		 no upstream, https://github.com/erlang/otp/commit/94776b53bed0ebfec163b20724a3f0e28f561a43 2026-08-20
CVE-2026-75538-1.patch Avoid signed int overflows Raimo Niskanen <raimo@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/08e8efdba8500d2d6f54c6b1de1492b228017c9b 2026-08-21
CVE-2026-75538-2.patch Test `{packet,4}` signed int overflow and memory corruption Raimo Niskanen <raimo@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/6432aeb0966652b12e6e7ee56b0fb5b1511e426d 2026-08-26
CVE-2026-69664.patch inets: Fix rejection of invalid chunk sizes
Before this fix the server would hang indefinitely without the need
to send any bytes to keep it running. This causes it to leak a process
which could be used to DOS the server.		 Lukas Backström <lukas@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/a3adf63078438c86527d704e23282b7721d8ca12 2026-06-01
CVE-2026-74835-1.patch inets: Fix max_body_size to apply to chunks as we receive them
Before this fix we only checked the max body size when a complete
chunk was received. Now we do a sanity check of the size first
and then we also check the data we receive so that a client that
sends more data than is allowed is stopped.		 Lukas Backström <lukas@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86 2026-06-02
CVE-2026-73270-1.patch inets: Canonicalize request path before mod_auth directory check
The mod_auth directory-matching logic uses re:run/3 to check whether
a resolved filesystem path falls inside a protected directory block.
This comparison is sensitive to path variants that the operating system
treats as equivalent: repeated slashes (//) and, on case-insensitive
filesystems (macOS, Windows), case differences.

Collapse consecutive slashes and, when the underlying filesystem is
case-insensitive, normalize case before the authorization decision so
that mod_auth, mod_security, and mod_get all operate on the same
canonical path.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6 2026-08-07
CVE-2026-70399.patch inets: Fix default max_clients
The documentation specified the max_clients to be 150 by default,
but the implementation did not respect that default, so it allowed
an infinite amount of clients.

CVE-2026-74835-1.patch (chunked_body_size_unbounded test), placed as in
upstream merge 1b7fe21f15.		 Lukas Backström <lukas@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612 2026-06-01
CVE-2026-74994.patch inets: Fix per-directory auth namespace isolation for dets/mnesia
The mod_auth dets and mnesia backends used a key that did not include
the directory path, causing all user/group records to collapse into a
single per-listener namespace. A user added to one protected directory
could authenticate against any other protected directory on the same
server.

The root cause was that {path, Directory} was never included in
DirData when passed to the auth backend modules. Both the HTTP request
authentication path (secretp/2) and the admin API path
(mod_auth_server) now inject {path, Directory} into DirData before
calling the backend, ensuring that dets/mnesia keys are scoped
per-directory as documented.

Add auth_directory_isolation test case to verify cross-directory
access is denied for both dets and mnesia backends.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/6982e381137ede21a4e1faf5fa2dd82321691176 2026-07-24
CVE-2026-66357.patch inets: Reject obs-fold header continuation in httpd (RFC 9112)
A line starting with SP or HTAB after CRLF in HTTP headers (obs-fold)
was parsed as an independent header by httpd. The key_value/1 helper
strips leading whitespace, promoting the continuation content to a
standalone header. This enables CL.TE request smuggling when httpd
sits behind a folding-aware reverse proxy.

RFC 9112 Section 5.2 requires that a server which does not support
obs-fold MUST reject such requests with 400 Bad Request.

Add a clause in parse_headers/7 that detects obs-fold (SP/HTAB after
CRLF) and returns {error, {bad_request, 400, _}, Version}. Add a
matching error handler in httpd_request_handler to send the 400
response to the client.

of this commit; the generic {bad_request, Code, Reason} handler is already
present via CVE-2026-23941.patch.		 Konrad Pietrzak <konrad@erlang.org> no upstream, https://github.com/erlang/otp/commit/220d618d2479a7180b4a06d0c5aacfaa4af4a85b 2026-07-27
CVE-2026-73812.patch inets: Reject requests with both Transfer-Encoding and Content-Length
A request containing both Transfer-Encoding and Content-Length
headers is now rejected with 400 Bad Request, as recommended by
RFC 9112 Section 6.3. Such a message indicates a potential request
smuggling attempt (CL.TE desync) and ought to be handled as an
error.

Add a bad_request error handler in httpd_request_handler to ensure
a proper 400 response is sent (instead of dropping the connection)
when the parser rejects a request.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/591dc00dc99dc2a426167a3b5257c0c94bd45e91 2026-07-27
CVE-2026-74835-2.patch Fix httpd_basic_SUITE:chunked_body_size_unbounded/1 testcase for patch-base-27 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/faa928205bdf20d533e68720eac003a43d3595f0 2026-08-17
CVE-2026-73276-1.patch inets: Reject headers with whitespace before colon in httpd
"Content-Length : 6" (space before colon) was silently dropped by
key_value/1, causing content-length to default to "0". The orphaned
body bytes were then reinterpreted as the next pipelined request via
body_data/2, enabling CL.0 request smuggling/desync.

RFC 7230 Section 3.2.4 states that no whitespace is allowed between
the header field-name and colon, and such requests must be rejected.

Return {error, whitespace_before_colon} from key_value/1 instead of
undefined for this case. Handle it in parse_headers/7 by returning
{error, {bad_request, 400, _}, Version}.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683 2026-07-27
CVE-2026-73270-2.patch inets: Add caseless matching to mod_security directory lookup
Add the caseless option to the re:run/3 call in secret_path/3,
mirroring the mod_auth fix, so mod_security attributes requests
to the correct directory regardless of path case.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/15ca963c351fd314bde5faa2eaeccb25ecf4754e 2026-08-20
CVE-2026-73276-2.patch httpd: add error handling for headers with whitespace before colon Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/226f936eb005d6a8f0130a2110453763a8b82f2d 2026-08-20
CVE-2026-71380-1.patch inets: Adjust keep_alive_timeout effective measurement in httpd
keep_alive_timeout would check the time between opening a connection,
or right after sending a response, until the next request's headers
are parsed.
Now the timeout is cancelled as soon as new data arrives, before the
parsing.
Allow atom `infinity` as a value for keep_alive_timeout to disable the
timeout entirely.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/d9500b1fd1139d65a51de079dbeaf86194a3effd 2026-08-19
CVE-2026-71380-2.patch inets: Add httpd option max_body_read_timeout
This option sets a max timeout for how long a body read will wait
for there to be more data delivered before it is terminated.

A similar limit can be set by using max_bytes_per_second, but that
is much harder to tune and predict, so we add a new option that
reflects how nginx handles such timeouts.		 Lukas Backström <lukas@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/f46293c977608e5656aaa2a78a5492faccd0fe09 2026-08-12
CVE-2026-71380-3.patch inets: Send 408 when we hit min_bytes_per_second floor Lukas Backström <lukas@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/3bc8abe9d1e8f767389b1762cbebee651874775d 2026-06-01
CVE-2026-71380-4.patch inets: rename max_body_read_timeout option to request_timeout
- Rename the max_body_read_timeout option to request_timeout
(default unchanged, 60 seconds), matching its documented purpose
of bounding idle time between message chunk reads.
- Rename HTTP_MAX_BODY_READ_TIMEOUT macro to HTTP_REQUEST_READ_TIMEOUT.
- Rename #state fields timeout/body_timeout to keepalive_timeout/
request_timeout in httpd_request_handler, and the corresponding
activate_body_timeout/reset_body_timeout functions to
activate_request_timeout/reset_request_timeout.
- Guard activate_keepalive_timeout/1 with timer = undefined so it
only arms a fresh timer, instead of unconditionally overwriting
a running one.
- Update httpd.erl -doc and -spec LimitOption references, and widen
keep_alive_timeout/request_timeout types to include infinity().
- Update httpd_basic_SUITE to use the renamed request_timeout option.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/81b453aac5a006bb8d26405f2bc3cf24e9d7733c 2026-08-19
CVE-2026-71380-5.patch Fix dialyzer errors in httpd_request_handler Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/10185f3ff9be205cdaa3f6331256f9b8bb91bbc2 2026-08-24
CVE-2026-55951.patch inets,stdlib,eldap: Bound integer parsing to mitigate DoS
inets (httpc):
- Add per-request max_header_size and max_body_size options
- Enforce cumulative header byte count during parsing; reject with
{error, {header_too_long, {max, MaxSize}}} when exceeded
- Default max_header_size is 10240 (same as httpd)
- Validate Content-Length contains only digits before storing,
preventing badarg crashes on malformed responses
- Update limits from new request options on connection reuse
- Catch validation throws in handler, return clean errors to caller
- Document new options in request/4,5 docstring

stdlib (uri_string):
- Bound port component digit count in uri_string:parse/1

eldap:
- Bound port digit count in referral URL parsing

snmp:
- Bound INTEGER value to max 32-bit value as in SMI-MIB
- Bound Counter32/Gauge32/TimeTicks to 5 bytes (32-bit + sign)
- Bound Counter64 to 9 bytes (64-bit + sign)

Mitigates GHSA-8qw4-2chm-mvj2.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d 2026-06-25
CVE-2026-59696.patch inets,stdlib,eldap: Bound integer parsing to mitigate DoS
inets (httpc):
- Add per-request max_header_size and max_body_size options
- Enforce cumulative header byte count during parsing; reject with
{error, {header_too_long, {max, MaxSize}}} when exceeded
- Default max_header_size is 10240 (same as httpd)
- Validate Content-Length contains only digits before storing,
preventing badarg crashes on malformed responses
- Update limits from new request options on connection reuse
- Catch validation throws in handler, return clean errors to caller
- Document new options in request/4,5 docstring

stdlib (uri_string):
- Bound port component digit count in uri_string:parse/1

eldap:
- Bound port digit count in referral URL parsing

snmp:
- Bound INTEGER value to max 32-bit value as in SMI-MIB
- Bound Counter32/Gauge32/TimeTicks to 5 bytes (32-bit + sign)
- Bound Counter64 to 9 bytes (64-bit + sign)

Mitigates GHSA-8qw4-2chm-mvj2.

GHSA-8qw4-2chm-mvj2) is taken here. The inets/httpc (CVE-2026-55951),
eldap (CVE-2026-70409) and snmp (CVE-2026-70405) parts of the same
upstream commit are handled by their own CVE patches.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d 2026-06-25
CVE-2026-70409.patch inets,stdlib,eldap: Bound integer parsing to mitigate DoS
inets (httpc):
- Add per-request max_header_size and max_body_size options
- Enforce cumulative header byte count during parsing; reject with
{error, {header_too_long, {max, MaxSize}}} when exceeded
- Default max_header_size is 10240 (same as httpd)
- Validate Content-Length contains only digits before storing,
preventing badarg crashes on malformed responses
- Update limits from new request options on connection reuse
- Catch validation throws in handler, return clean errors to caller
- Document new options in request/4,5 docstring

stdlib (uri_string):
- Bound port component digit count in uri_string:parse/1

eldap:
- Bound port digit count in referral URL parsing

snmp:
- Bound INTEGER value to max 32-bit value as in SMI-MIB
- Bound Counter32/Gauge32/TimeTicks to 5 bytes (32-bit + sign)
- Bound Counter64 to 9 bytes (64-bit + sign)

Mitigates GHSA-8qw4-2chm-mvj2.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d 2026-06-25
CVE-2026-70405.patch inets,stdlib,eldap: Bound integer parsing to mitigate DoS
inets (httpc):
- Add per-request max_header_size and max_body_size options
- Enforce cumulative header byte count during parsing; reject with
{error, {header_too_long, {max, MaxSize}}} when exceeded
- Default max_header_size is 10240 (same as httpd)
- Validate Content-Length contains only digits before storing,
preventing badarg crashes on malformed responses
- Update limits from new request options on connection reuse
- Catch validation throws in handler, return clean errors to caller
- Document new options in request/4,5 docstring

stdlib (uri_string):
- Bound port component digit count in uri_string:parse/1

eldap:
- Bound port digit count in referral URL parsing

snmp:
- Bound INTEGER value to max 32-bit value as in SMI-MIB
- Bound Counter32/Gauge32/TimeTicks to 5 bytes (32-bit + sign)
- Bound Counter64 to 9 bytes (64-bit + sign)

Mitigates GHSA-8qw4-2chm-mvj2.		 Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d 2026-06-25
CVE-2026-71380-6.patch Gate keep_alive_timeout in httpd_bench_SUITE Konrad Pietrzak <konrad@erlang.org> no debian upstream, https://github.com/erlang/otp/commit/3bdf3b1ff73efe4e39c6d924b20140eb49bdb08e 2026-08-31
CVE-2026-65634.patch asn1: Mitigate a DoS vector John Högberg <john@erlang.org> no upstream, https://github.com/erlang/otp/commit/0fe2c02fdc06fab1c63be9db1a7456993d20f838 2026-07-28
CVE-2026-89422.patch ssl: Reject unsolicited TLS-1.3 pre_shared_key in client
A TLS-1.3 client that offered no PSK accepted a ServerHello carrying a
pre_shared_key extension: get_pre_shared_key/4 fell back to the all-zero
"no PSK" value and handle_resumption/2 set resumption=true on the mere
presence of the extension, routing the client past the certificate
states (wait_cert_cr/wait_cert/wait_cv) straight to wait_finished. Since
the handshake is keyed with the ordinary non-PSK schedule, any peer that
completes ECDHE could impersonate any server to a verify_peer client
without presenting a certificate (server-authentication bypass).

Fix (RFC 8446 4.2.11): in get_pre_shared_key/4 every clause reachable
only when the server DID send pre_shared_key now aborts with a fatal
illegal_parameter alert (reason {unsolicited_pre_shared_key, _}) instead
of returning the zero PSK - the client offered no identities, so
selected_identity cannot be in range. The auto clause still unlocks
tickets first. This alone closes the hole: handle_server_hello/2 fails
in wait_sh before any keys are derived.

Defence in depth: move the handle_resumption/2 call in
handle_server_hello/2 to after get_pre_shared_key/4 has accepted the
server's PSK selection, so resumption mode can never be entered for a
PSK the client did not offer.

Add regression test tls13_reject_unsolicited_psk (rogue_server_tests
group in tls_api_SUITE): a certificate-less raw-TCP TLS-1.3 server sends
an otherwise-valid flight with an unsolicited pre_shared_key. Verified
the test fails (client connects) without the fix and passes
(illegal_parameter) with it. Covers session_tickets=disabled and =auto.		 Ingela Anderton Andin <ingela@erlang.org> no upstream, https://github.com/erlang/otp/commit/fd1d9d07fc92ec0d59f96dfb66182195882bb7dd 2026-09-16
CVE-2026-68956-1.patch ssh: Limit size of channel cache entries Michał Wąsowski <michal@erlang.org> no upstream, https://github.com/erlang/otp/commit/e2bbad0107bba41491a4d549686fd023db8740da 2026-08-31
CVE-2026-68956-2.patch ssh: Change max_sessions and max_channels defaults and update terminology
lib/ssh/doc/guides/terminology.md dropped.		 Michał Wąsowski <michal@erlang.org> no upstream, https://github.com/erlang/otp/commit/e2a9be0a4b0035331ae6432b258d446dd5e7579a 2026-08-31
CVE-2026-68956-3.patch ssh: Prevent duplicate subsystem spawns on same channel Michał Wąsowski <michal@erlang.org> no upstream, https://github.com/erlang/otp/commit/255b98b0380b4f5254e0c8ffdde994458c4c24d1 2026-08-24
CVE-2026-68956-4.patch ssh: Allow subsystem to start after env and pty requests Michał Wąsowski <michal@erlang.org> no upstream, https://github.com/erlang/otp/commit/1c8a6c17578da315fd5bb2c3c2f84fe33ec34da8 2026-09-18
CVE-2026-70405-followup.patch Merge branch 'whaileee/snmp/ber-integer-limits/patch-base-27/OTP-20428' into maint-27
* whaileee/snmp/ber-integer-limits/patch-base-27/OTP-20428:
snmp: Bound integer parsing in the BER decoder

# Conflicts:
# lib/snmp/src/misc/snmp_pdus.erl		 Erlang/OTP <otp@erlang.org> no upstream, https://github.com/erlang/otp/commit/787840115f9ead11559a90c0d0aa61ddf4e959b7 2026-10-14

All known versions for source package 'erlang'

Links