Executive brief
Erlang/OTP's TCP networking driver contains a packet parsing vulnerability that allows an unauthenticated attacker to send specially crafted network packets to an exposed Erlang port. This can cause a buffer overflow that crashes the Erlang virtual machine (BEAM), resulting in service unavailability. While remote code execution is theoretically possible, it would be extremely difficult to achieve in practice.
Technical details
A signed integer overflow in the inet driver's packet length calculation when using {packet,4} mode allows an attacker to overwrite the receive buffer beyond its allocated bounds. The vulnerability stems from incorrect validation of the packet length field, permitting values that wrap around due to signed integer arithmetic. An unauthenticated attacker with network access to an open Erlang TCP port can exploit this with a single malicious connection. The overflow corrupts the BEAM VM's memory allocator metadata and adjacent heap blocks, reliably causing a denial of service (crash). Remote code execution is considered infeasible due to the difficulty of achieving sufficient precision over the corrupted memory layout.
Affected products
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixes released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6