# CVE-2026-54890: Erlang OTP denial of service via integer underflow in ETF decoder

Source: https://junglewise.ai/threats/cve-2026-54890-erlang-otp-denial-of-service-via-integer-underflow-in-etf-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-54890 · Severity: info · CVSS 8.2 · Published 2026-07-27

Erlang/OTP is a programming platform used to build highly available, distributed systems like messaging apps and financial switches. A flaw in how it processes external data allows an attacker to crash the entire system by sending a specially crafted 7-byte message. Because this crash happens at the core engine level, standard error-handling and recovery mechanisms cannot prevent the system from shutting down, potentially leading to a total service outage.

Technologies: [Erlang Erts](https://junglewise.ai/threats/technologies/erts), [Erlang OTP](https://junglewise.ai/threats/technologies/otp). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-54890 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54890 being exploited in the wild.

**How severe is CVE-2026-54890?** Informational severity, with a CVSS score of 8.2, published 27 July 2026.

**Which products and versions are affected?** Erlang Erts 15.0 to 15.2.7.10, 16.0 to 16.4.0.3, 17.0 to 17.0.3; Erlang OTP 27.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3.

**Is there a fix for CVE-2026-54890?** A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54890 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54890?** Check whether you run Erlang Erts or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow vulnerability exists in the BIT_BINARY_EXT (tag 77) handler within the External Term Format (ETF) decoder, specifically in 'erts/emulator/beam/external.c'. When the decoder encounters an encoding where both the length and trailing-bits fields are set to zero, a subsequent size calculation underflows an unsigned integer. This results in an extremely large value (approximately 2^64) being passed to the memory allocator, triggering a VM-level abort. The crash bypasses Erlang-level error handling, including try/catch blocks and supervision trees, as well as the 'safe' option in 'binary_to_term/2'. The vulnerability is reachable via any application decoding ETF from untrusted sources or through the Erlang distribution protocol. Patches are available in OTP versions 27.3.4.15, 28.5.0.4, and 29.0.4.

## Affected products

- Erlang OTP 27.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3
- Erlang ERTS 15.0 to 15.2.7.10, 16.0 to 16.4.0.3, 17.0 to 17.0.3

## Timeline

- 2026-07-27: advisory: GHSA-54pw-5645-jh86 published
- 2026-07-27: disclosed: CVE-2026-54890 published
- 2026-07-27: patched

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-54890.html](https://cna.erlef.org/cves/CVE-2026-54890.html)
- [https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd](https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd)
- [https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86](https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)