Executive brief
Erlang/OTP is a programming platform used to build highly available, distributed systems like messaging apps and financial switches. A flaw in how it processes external data allows an attacker to crash the entire system by sending a specially crafted 7-byte message. Because this crash happens at the core engine level, standard error-handling and recovery mechanisms cannot prevent the system from shutting down, potentially leading to a total service outage.
Technical details
An integer underflow vulnerability exists in the BIT_BINARY_EXT (tag 77) handler within the External Term Format (ETF) decoder, specifically in 'erts/emulator/beam/external.c'. When the decoder encounters an encoding where both the length and trailing-bits fields are set to zero, a subsequent size calculation underflows an unsigned integer. This results in an extremely large value (approximately 2^64) being passed to the memory allocator, triggering a VM-level abort. The crash bypasses Erlang-level error handling, including try/catch blocks and supervision trees, as well as the 'safe' option in 'binary_to_term/2'. The vulnerability is reachable via any application decoding ETF from untrusted sources or through the Erlang distribution protocol. Patches are available in OTP versions 27.3.4.15, 28.5.0.4, and 29.0.4.
Affected products
- Erlang OTP 27.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3
- Erlang ERTS 15.0 to 15.2.7.10, 16.0 to 16.4.0.3, 17.0 to 17.0.3
Timeline
- 2026-07-27: advisory: GHSA-54pw-5645-jh86 published
- 2026-07-27: disclosed: CVE-2026-54890 published
- 2026-07-27: patched