Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54890— BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

CVSS 8.2 · High EPSS 0.32% · P24

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

VendorProductVersion RangeStatus
ErlangOTP15.0< *affected
27.0< *affected
24ef4cbaeda9b9c26682cba75f2f15b0c58722aa< dc1bf9344c0ce62717cf60866590cea0242780fdaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-54890

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
Source: CVE Program / CVE List V5
Vulnerability Description
Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)". The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings). Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5
Vulnerability Title
erlang/otp 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
erlang erlang/otp是erlang社区开源的一套并发编程语言及运行时系统。 erlang/otp 27.0版本至29.0.4之前版本存在安全漏洞，该漏洞源于External Term Format解码器中BIT_BINARY_EXT标签处理不当，导致整数下溢，进而引发强制整数溢出和过度分配内存，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
ErlangOTP 15.0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
ErlangOTP 27.0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-54890

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54890

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54890 (1)

Vendor Advisories for CVE-2026-54890 (3)

Same Patch Batch · Erlang · 2026-07-27 · 8 CVEs total

CVE-2026-559539.1 CRITICALTLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authent
CVE-2026-582278.7 HIGHTLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
CVE-2026-592518.7 HIGHDenial of service via exponential certificate policy tree growth in path validation
CVE-2026-592508.3 HIGHMegaco flex scanner buffer overflow via oversized property parm name
CVE-2026-427926.3 MEDIUMepmd permanent DoS via EMFILE on accept(2) in erts
CVE-2026-557375.1 MEDIUMHeap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts e
CVE-2026-470784.8 MEDIUMRelative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass

IV. Related Vulnerabilities

Same product: OTP
Same vendor: Erlang
Same weakness: CWE-191

V. Comments for CVE-2026-54890

No comments yet

Leave a comment