Executive brief
A vulnerability in the Erlang runtime system's network driver could allow a remote attacker to crash the virtual machine. This affects systems using the SCTP protocol, potentially leading to a total service outage. While the primary risk is a denial-of-service, there is also a minor risk of small amounts of internal memory being leaked to the application layer.
Technical details
A stack-based buffer overflow exists in the sctp_parse_error_chunk function within erts/emulator/drivers/common/inet_drv.c. The vulnerability is caused by writing SCTP error cause codes into a fixed-size stack-allocated array (spec[]) without proper bounds checking. An unauthenticated remote attacker with an established SCTP association can trigger the overflow by sending a crafted SCTP ERROR chunk containing excessive cause codes. While the overflow can crash the BEAM VM (Denial of Service), the attacker's control is limited to 16-bit values interleaved with fixed tags, making arbitrary code execution unlikely on systems with standard stack protections. The issue is fixed in OTP versions 27.3.4.13, 28.5.0.2, and 29.0.2.
Affected products
- Erlang OTP 17.0 to 27.3.4.12, 28.5.0.1, 29.0.1
- Erlang erts 6.0 to 15.2.7.8, 16.4.0.1, 17.0.1
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-06-10: patched