PatchTheCVEerlang vulnerabilities
Recent CVEs affecting erlang products. 6 tracked.
erlang has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-07-27. Highest priority: CVE-2026-42792 (score 40/100).
- CVE-2026-42792 HIGH 7.5 UPGRADE UPGRADE Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated
- CVE-2026-54890 HIGH 7.5 UPGRADE UPGRADE Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts
- CVE-2026-58227 HIGH 7.5 UPGRADE UPGRADE The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain
- CVE-2026-59251 HIGH 7.5 UPGRADE UPGRADE Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote un
- CVE-2026-55737 HIGH 7.5 UPGRADE UPGRADE Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacke
- CVE-2026-55953 HIGH 7.4 UPGRADE UPGRADE The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the
FAQ
How do I fix erlang vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is erlang being exploited right now?
None of the tracked erlang CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which erlang CVE should I patch first?
CVE-2026-42792 currently ranks highest (40/100): Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated .