CVE-2026-54890

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54890", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-06-16T10:47:13.915Z", "datePublished": "2026-07-27T15:39:03.475Z", "dateUpdated": "2026-11-11T18:47:44.385Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["erts"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["erts/emulator/beam/external.c"], "programRoutines": [{"name": "erlang:binary_to_term/1"}, {"name": "erlang:binary_to_term/2"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.15", "status": "unaffected"}, {"at": "28.5.0.4", "status": "unaffected"}, {"at": "29.0.4", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "27.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["erts"], "packageName": "erts", "packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["emulator/beam/external.c"], "programRoutines": [{"name": "erlang:binary_to_term/1"}, {"name": "erlang:binary_to_term/2"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "15.2.7.11", "status": "unaffected"}, {"at": "16.4.0.4", "status": "unaffected"}, {"at": "17.0.4", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "15.0", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["erts"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["erts/emulator/beam/external.c"], "programRoutines": [{"name": "erlang:binary_to_term/1"}, {"name": "erlang:binary_to_term/2"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "dc1bf9344c0ce62717cf60866590cea0242780fd", "status": "affected", "version": "24ef4cbaeda9b9c26682cba75f2f15b0c58722aa", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.15", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.5.0.4", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "29.0.4", "versionStartIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Paul Guyot"}, {"lang": "en", "type": "finder", "value": "Lukas Backstr\u00f6m"}, {"lang": "en", "type": "remediation developer", "value": "John H\u00f6gberg"}], "datePublic": "2026-07-27T15:39:03.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files <code>erts/emulator/beam/external.c</code>, <code>emulator/beam/external.c</code>.</p>\n<p>The <code>BIT_BINARY_EXT</code> tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as <code>Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\")</code>.</p>\n<p>The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by <code>try</code>/<code>catch</code>, or by passing the <code>[safe]</code> option to <code>binary_to_term/2</code> (which only restricts atom creation and does not perform structural validation of binary encodings).</p>\n<p>Any application that decodes ETF from untrusted sources via <code>binary_to_term/1,2</code> or <code>enif_binary_to_term()</code> is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).</p>\n<p>This issue affects OTP from OTP&nbsp;27.0 before OTP&nbsp;27.3.4.15, OTP&nbsp;28.5.0.4, and OTP&nbsp;29.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.</p>"}, {"base64": false, "type": "text/markdown", "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files `erts/emulator/beam/external.c`, `emulator/beam/external.c`.\n\nThe `BIT_BINARY_EXT` tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as `Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\")`.\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by `try`/`catch`, or by passing the `[safe]` option to `binary_to_term/2` (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via `binary_to_term/1,2` or `enif_binary_to_term()` is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.15, OTP\u00a028.5.0.4, and OTP\u00a029.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4."}], "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\").\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.15, OTP\u00a028.5.0.4, and OTP\u00a029.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4."}], "impacts": [{"capecId": "CAPEC-92", "descriptions": [{"lang": "en", "value": "CAPEC-92 Forced Integer Overflow"}]}, {"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T18:47:44.385Z"}, "references": [{"name": "binary_to_term crash on crafted BIT_BINARY_EXT input", "tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86"}, {"name": "EEF CNA record for CVE-2026-54890", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-54890.html"}, {"name": "OSV record EEF-CVE-2026-54890", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-54890"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Introducing commit 24ef4cb in erlang/otp", "tags": ["related"], "url": "https://github.com/erlang/otp/commit/24ef4cbaeda9b9c26682cba75f2f15b0c58722aa"}, {"name": "Fix commit dc1bf93 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd"}], "source": {"discovery": "EXTERNAL"}, "title": "BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Do not call <code>binary_to_term/1,2</code> or <code>enif_binary_to_term()</code> on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.</p>"}, {"base64": false, "type": "text/markdown", "value": "Do not call `binary_to_term/1,2` or `enif_binary_to_term()` on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead."}], "value": "Do not call binary_to_term/1,2 or enif_binary_to_term() on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T18:18:57.223218Z", "id": "CVE-2026-54890", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T18:19:08.876Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54890", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T18:18:57.223218Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T18:19:03.450Z"}}], "cna": {"title": "BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Paul Guyot"}, {"lang": "en", "type": "finder", "value": "Lukas Backstr\u00f6m"}, {"lang": "en", "type": "remediation developer", "value": "John H\u00f6gberg"}], "impacts": [{"capecId": "CAPEC-92", "descriptions": [{"lang": "en", "value": "CAPEC-92 Forced Integer Overflow"}]}, {"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "modules": ["erts"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "27.3.4.15", "status": "unaffected"}, {"at": "28.5.0.4", "status": "unaffected"}, {"at": "29.0.4", "status": "unaffected"}], "version": "27.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["erts/emulator/beam/external.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "erlang:binary_to_term/1"}, {"name": "erlang:binary_to_term/2"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["erts"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "15.2.7.11", "status": "unaffected"}, {"at": "16.4.0.4", "status": "unaffected"}, {"at": "17.0.4", "status": "unaffected"}], "version": "15.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "erts", "programFiles": ["emulator/beam/external.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "erlang:binary_to_term/1"}, {"name": "erlang:binary_to_term/2"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["erts"], "product": "OTP", "versions": [{"status": "affected", "version": "24ef4cbaeda9b9c26682cba75f2f15b0c58722aa", "lessThan": "dc1bf9344c0ce62717cf60866590cea0242780fd", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["erts/emulator/beam/external.c"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "erlang:binary_to_term/1"}, {"name": "erlang:binary_to_term/2"}]}], "datePublic": "2026-07-27T15:39:03.000Z", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86", "name": "binary_to_term crash on crafted BIT_BINARY_EXT input", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-54890.html", "name": "EEF CNA record for CVE-2026-54890", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-54890", "name": "OSV record EEF-CVE-2026-54890", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/24ef4cbaeda9b9c26682cba75f2f15b0c58722aa", "name": "Introducing commit 24ef4cb in erlang/otp", "tags": ["related"]}, {"url": "https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd", "name": "Fix commit dc1bf93 in erlang/otp", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Do not call binary_to_term/1,2 or enif_binary_to_term() on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.", "supportingMedia": [{"type": "text/html", "value": "<p>Do not call <code>binary_to_term/1,2</code> or <code>enif_binary_to_term()</code> on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.</p>", "base64": false}, {"type": "text/markdown", "value": "Do not call `binary_to_term/1,2` or `enif_binary_to_term()` on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\").\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.15, OTP\u00a028.5.0.4, and OTP\u00a029.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.", "supportingMedia": [{"type": "text/html", "value": "<p>Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files <code>erts/emulator/beam/external.c</code>, <code>emulator/beam/external.c</code>.</p>\n<p>The <code>BIT_BINARY_EXT</code> tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as <code>Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\")</code>.</p>\n<p>The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by <code>try</code>/<code>catch</code>, or by passing the <code>[safe]</code> option to <code>binary_to_term/2</code> (which only restricts atom creation and does not perform structural validation of binary encodings).</p>\n<p>Any application that decodes ETF from untrusted sources via <code>binary_to_term/1,2</code> or <code>enif_binary_to_term()</code> is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).</p>\n<p>This issue affects OTP from OTP&nbsp;27.0 before OTP&nbsp;27.3.4.15, OTP&nbsp;28.5.0.4, and OTP&nbsp;29.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.</p>", "base64": false}, {"type": "text/markdown", "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files `erts/emulator/beam/external.c`, `emulator/beam/external.c`.\n\nThe `BIT_BINARY_EXT` tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as `Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\")`.\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by `try`/`catch`, or by passing the `[safe]` option to `binary_to_term/2` (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via `binary_to_term/1,2` or `enif_binary_to_term()` is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.15, OTP\u00a028.5.0.4, and OTP\u00a029.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.15", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.5.0.4", "versionStartIncluding": "28.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "29.0.4", "versionStartIncluding": "29.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T18:47:44.385Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54890", "state": "PUBLISHED", "dateUpdated": "2026-11-11T18:47:44.385Z", "dateReserved": "2026-06-16T10:47:13.915Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-07-27T15:39:03.475Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["erts"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["erts/emulator/beam/external.c"], "programRoutines": [{"name": "erlang:binary_to_term/1"}, {"name": "erlang:binary_to_term/2"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.15", "status": "unaffected"}, {"at": "28.5.0.4", "status": "unaffected"}, {"at": "29.0.4", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "27.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["erts"], "packageName": "erts", "packageURL": "pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["emulator/beam/external.c"], "programRoutines": [{"name": "erlang:binary_to_term/1"}, {"name": "erlang:binary_to_term/2"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "15.2.7.11", "status": "unaffected"}, {"at": "16.4.0.4", "status": "unaffected"}, {"at": "17.0.4", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "15.0", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["erts"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["erts/emulator/beam/external.c"], "programRoutines": [{"name": "erlang:binary_to_term/1"}, {"name": "erlang:binary_to_term/2"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "dc1bf9344c0ce62717cf60866590cea0242780fd", "status": "affected", "version": "24ef4cbaeda9b9c26682cba75f2f15b0c58722aa", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7740717-E30D-4D4B-8226-037788AA2440", "versionEndExcluding": "27.3.4.15", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "E5A403B9-F8C0-42F9-9CDD-AE95FBBA58BC", "versionEndExcluding": "28.5.0.4", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "4325E198-43FA-4DD1-99A5-66705CF21615", "versionEndExcluding": "29.0.4", "versionStartIncluding": "29.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erts:*:*:*:*:*:*:*:*", "matchCriteriaId": "11B1C890-908F-4DA6-BA70-903488089424", "versionEndExcluding": "15.2.7.11", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erts:*:*:*:*:*:*:*:*", "matchCriteriaId": "31D9076A-4078-4597-A518-12B6E55007B8", "versionEndExcluding": "16.4.0.4", "versionStartIncluding": "16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erts:*:*:*:*:*:*:*:*", "matchCriteriaId": "7EC53F68-5A92-4EF5-8789-1905C50D85BF", "versionEndExcluding": "17.0.4", "versionStartIncluding": "17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\").\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.15, OTP\u00a028.5.0.4, and OTP\u00a029.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento negativo de entero (wrap o wraparound) en erlang otp erlang/otp (m\u00f3dulos erts), erlang otp erts (m\u00f3dulos erts) permite el desbordamiento de entero forzado, asignaci\u00f3n excesiva. Esta vulnerabilidad est\u00e1 asociada con los archivos de programa erts/emulator/beam/external.c, emulator/beam/external.c.\n\nEl gestor de la etiqueta BIT_BINARY_EXT (77) en el decodificador de Formato de T\u00e9rmino Externo (ETF) acepta una codificaci\u00f3n con los campos de longitud y bits finales (trailing-bits) establecidos a cero. El c\u00e1lculo subsiguiente del tama\u00f1o de la cadena de bits (bitstring) causa un desbordamiento negativo en un entero sin signo, produciendo un valor de aproximadamente 2^64 que luego se pasa como tama\u00f1o de asignaci\u00f3n de memoria. El asignador aborta el nodo completo con un mensaje como \u2019Cannot allocate 2305843009213693951 bytes of memory (of type binary)\u2019.\n\nEl fallo es una anulaci\u00f3n a nivel de VM, no una excepci\u00f3n a nivel de Erlang. No puede ser interceptado por \u00e1rboles de supervisi\u00f3n, por try/catch, o pasando la opci\u00f3n [safe] a binary_to_term/2 (que solo restringe la creaci\u00f3n de \u00e1tomos y no realiza la validaci\u00f3n estructural de las codificaciones binarias).\n\nCualquier aplicaci\u00f3n que decodifique ETF de fuentes no confiables a trav\u00e9s de binary_to_term/1,2 o enif_binary_to_term() est\u00e1 expuesta. El protocolo de distribuci\u00f3n de Erlang tambi\u00e9n decodifica los t\u00e9rminos entrantes a trav\u00e9s de la misma ruta de c\u00f3digo, pero se espera que la distribuci\u00f3n se ejecute en redes confiables seg\u00fan las Directrices de Codificaci\u00f3n Segura de OTP (DSG-011).\n\nEste problema afecta a OTP desde OTP 27.0 antes de OTP 29.0.4, OTP 28.5.0.4 y OTP 27.3.4.15, correspondiendo a erts desde 15.0 antes de 17.0.4, 16.4.0.4 y 15.2.7.11."}], "id": "CVE-2026-54890", "lastModified": "2026-11-11T19:17:41.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54890", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-27T18:18:57.223218Z", "version": "2.0.3"}}]}, "published": "2026-07-27T16:17:41.437", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch", "Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-54890.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/24ef4cbaeda9b9c26682cba75f2f15b0c58722aa"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch", "Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-54890"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Release Notes"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}, {"lang": "en", "value": "CWE-789"}, {"lang": "en", "value": "CWE-1284"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "erlang/otp: erts: otp: Erlang/OTP: Denial of Service via integer underflow in ETF decoding", "id": "2507571", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507571"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["A flaw was found in Erlang/OTP. A remote attacker can exploit an integer underflow vulnerability in the External Term Format (ETF) decoder, specifically within the `binary_to_term` function. By sending a specially crafted ETF payload with a zero-length `BIT_BINARY_EXT` tag, the attacker can trigger an unsigned integer underflow. This leads to an attempt to allocate an excessively large amount of memory, causing the Erlang Virtual Machine (VM) to crash, resulting in a denial of service. This VM-level crash cannot be handled by standard Erlang error mechanisms."], "name": "CVE-2026-54890", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-27T15:39:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54890\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54890\nhttps://cna.erlef.org/cves/CVE-2026-54890.html\nhttps://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd\nhttps://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86\nhttps://osv.dev/vulnerability/EEF-CVE-2026-54890\nhttps://www.erlang.org/doc/system/versions.html#order-of-versions"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[27.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[24ef4cbaeda9b9c26682cba75f2f15b0c58722aa,dc1bf9344c0ce62717cf60866590cea0242780fd)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[27.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[24ef4cbaeda9b9c26682cba75f2f15b0c58722aa,dc1bf9344c0ce62717cf60866590cea0242780fd)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "created": "2026-07-27T18:00:03.833924+00:00", "updated": "2026-08-03T17:15:12.666152+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp", "erlang$PRODUCT$otp"]}