Is CVE-2026-49759 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49759 being exploited in the wild.

How severe is CVE-2026-49759?

Informational severity, with a CVSS score of 8.8, published 10 June 2026.

Which products and versions are affected?

Erlang Erts 6.0 to 15.2.7.8, 16.4.0.1, 17.0.1; Erlang OTP 17.0 to 27.3.4.12, 28.5.0.1, 29.0.1.

Is there a fix for CVE-2026-49759?

A patch was published on 2026-06-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49759 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49759?

Check whether you run Erlang Erts or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49759: Erlang OTP stack buffer overflow in SCTP error parsing in inet_drv

CVE-2026-49759 · Severity: info · CVSS 8.8 · Published 2026-06-10

A vulnerability in the Erlang runtime system's network driver could allow a remote attacker to crash the virtual machine. This affects systems using the SCTP protocol, potentially leading to a total service outage. While the primary risk is a denial-of-service, there is also a minor risk of small amounts of internal memory being leaked to the application layer.

Technologies: Erlang Erts, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-49759 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49759 being exploited in the wild.
How severe is CVE-2026-49759?: Informational severity, with a CVSS score of 8.8, published 10 June 2026.
Which products and versions are affected?: Erlang Erts 6.0 to 15.2.7.8, 16.4.0.1, 17.0.1; Erlang OTP 17.0 to 27.3.4.12, 28.5.0.1, 29.0.1.
Is there a fix for CVE-2026-49759?: A patch was published on 2026-06-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49759 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49759?: Check whether you run Erlang Erts or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the sctp_parse_error_chunk function within erts/emulator/drivers/common/inet_drv.c. The vulnerability is caused by writing SCTP error cause codes into a fixed-size stack-allocated array (spec[]) without proper bounds checking. An unauthenticated remote attacker with an established SCTP association can trigger the overflow by sending a crafted SCTP ERROR chunk containing excessive cause codes. While the overflow can crash the BEAM VM (Denial of Service), the attacker's control is limited to 16-bit values interleaved with fixed tags, making arbitrary code execution unlikely on systems with standard stack protections. The issue is fixed in OTP versions 27.3.4.13, 28.5.0.2, and 29.0.2.

Affected products

Erlang OTP 17.0 to 27.3.4.12, 28.5.0.1, 29.0.1
Erlang erts 6.0 to 15.2.7.8, 16.4.0.1, 17.0.1

Timeline

2026-06-10: disclosed
2026-06-10: advisory
2026-06-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.