Is CVE-2026-54890 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54890 being exploited in the wild.

How severe is CVE-2026-54890?

Informational severity, with a CVSS score of 8.2, published 27 July 2026.

Which products and versions are affected?

Erlang Erts 15.0 to 15.2.7.10, 16.0 to 16.4.0.3, 17.0 to 17.0.3; Erlang OTP 27.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3.

Is there a fix for CVE-2026-54890?

A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54890 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54890?

Check whether you run Erlang Erts or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54890: Erlang OTP denial of service via integer underflow in ETF decoder

CVE-2026-54890 · Severity: info · CVSS 8.2 · Published 2026-07-27

Erlang/OTP is a programming platform used to build highly available, distributed systems like messaging apps and financial switches. A flaw in how it processes external data allows an attacker to crash the entire system by sending a specially crafted 7-byte message. Because this crash happens at the core engine level, standard error-handling and recovery mechanisms cannot prevent the system from shutting down, potentially leading to a total service outage.

Technologies: Erlang Erts, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-54890 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54890 being exploited in the wild.
How severe is CVE-2026-54890?: Informational severity, with a CVSS score of 8.2, published 27 July 2026.
Which products and versions are affected?: Erlang Erts 15.0 to 15.2.7.10, 16.0 to 16.4.0.3, 17.0 to 17.0.3; Erlang OTP 27.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3.
Is there a fix for CVE-2026-54890?: A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54890 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54890?: Check whether you run Erlang Erts or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow vulnerability exists in the BIT_BINARY_EXT (tag 77) handler within the External Term Format (ETF) decoder, specifically in 'erts/emulator/beam/external.c'. When the decoder encounters an encoding where both the length and trailing-bits fields are set to zero, a subsequent size calculation underflows an unsigned integer. This results in an extremely large value (approximately 2^64) being passed to the memory allocator, triggering a VM-level abort. The crash bypasses Erlang-level error handling, including try/catch blocks and supervision trees, as well as the 'safe' option in 'binary_to_term/2'. The vulnerability is reachable via any application decoding ETF from untrusted sources or through the Erlang distribution protocol. Patches are available in OTP versions 27.3.4.15, 28.5.0.4, and 29.0.4.

Affected products

Erlang OTP 27.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3
Erlang ERTS 15.0 to 15.2.7.10, 16.0 to 16.4.0.3, 17.0 to 17.0.3

Timeline

2026-07-27: advisory: GHSA-54pw-5645-jh86 published
2026-07-27: disclosed: CVE-2026-54890 published
2026-07-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.