Skip to content
Heist/ feed
Back to feed
CriticalFix available

erlang security update

Type: advisorySources: OSV

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fix(es): Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rtt_ber:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_ber.erl and the equivalent PER helper asn1rtt_per_common:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_per_common.erl accumulate a base-128 subidentifier into an unbounded integer using (Av bsl 7) + H per continuation byte. Each shift and addition on the growing accumulator is linear in the number of bits already accumulated, giving quadratic total work in the size of a single subidentifier. The JER helper asn1rtt_jer:json2oid/1 in lib/asn1/src/asn1rtt_jer.erl exhibits the same class of unbounded-integer parsing when decoding a dot-separated OID from JSON. A DER-encoded OBJECT IDENTIFIER with one very large arc (approximately 262 KB of continuation bytes) consumes roughly 13 seconds of CPU on typical hardware. The vulnerable decoder is generated into every ASN.1 module that contains an OBJECT IDENTIFIER, including OTP-PUB-KEY which is reached during X.509 certificate parsing via public_key:pkix_decode_cert/2. This decoder runs before any signature or trust chain

Products
erlang
Affected versions
Not specified
Fixed versions
25.3.2.6-21.oe2403sp3
CVEs
CVE-2026-65634, CVE-2026-68956, CVE-2026-89422
Confirmed fixed CVEs
Not specified
Updated in this feed
30 Oct 2026, 20:39 UTC · Revision 1

Source evidence

erlang security update

core-osv · Original source

Published 16 Oct 2026, 11:58 UTC

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fix(es): Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rtt_ber:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_ber.erl and the equivalent PER helper asn1rtt_per_common:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_per_common.erl accumulate a base-128 subidentifier into an unbounded integer using (Av bsl 7) + H per continuation byte. Each shift and addition on the growing accumulator is linear in the number of bits already accumulated, giving quadratic total work in the size of a single subidentifier. The JER helper asn1rtt_jer:json2oid/1 in lib/asn1/src/asn1rtt_jer.erl exhibits the same class of unbounded-integer parsing when decoding a dot-separated OID from JSON. A DER-encoded OBJECT IDENTIFIER with one very large arc (approximately 262 KB of continuation bytes) consumes roughly 13 seconds of CPU on typical hardware. The vulnerable decoder is generated into every ASN.1 module that contains an OBJECT IDENTIFIER, including OTP-PUB-KEY which is reached during X.509 certificate parsing via public_key:pkix_decode_cert/2. This decoder runs before any signature or trust chain

osv:OESA-2026-4256

erlang

Fixed versions: 25.3.2.6-21.oe2403sp3

Complete source record
{
  "id": "0ad66453570c072d7d36f3cfeb82a38ae1f6fdad5f683bdce798b8301de37b94",
  "url": "https://osv.dev/vulnerability/OESA-2026-4256",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "erlang security update",
    "summary": "Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fix(es): Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rtt_ber:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_ber.erl and the equivalent PER helper asn1rtt_per_common:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_per_common.erl accumulate a base-128 subidentifier into an unbounded integer using (Av bsl 7) + H per continuation byte. Each shift and addition on the growing accumulator is linear in the number of bits already accumulated, giving quadratic total work in the size of a single subidentifier. The JER helper asn1rtt_jer:json2oid/1 in lib/asn1/src/asn1rtt_jer.erl exhibits the same class of unbounded-integer parsing when decoding a dot-separated OID from JSON. A DER-encoded OBJECT IDENTIFIER with one very large arc (approximately 262 KB of continuation bytes) consumes roughly 13 seconds of CPU on typical hardware. The vulnerable decoder is generated into every ASN.1 module that contains an OBJECT IDENTIFIER, including OTP-PUB-KEY which is reached during X.509 certificate parsing via public_key:pkix_decode_cert/2. This decoder runs before any signature or trust chain ",
    "evidence": "osv:OESA-2026-4256",
    "products": [
      {
        "name": {
          "value": "erlang",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "25.3.2.6-21.oe2403sp3",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "OESA-2026-4256",
      "aliases": [
        "OESA-2026-4256"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "25.3.2.6-21.oe2403sp3"
                }
              ]
            }
          ],
          "package": {
            "name": "erlang",
            "purl": "pkg:rpm/openEuler/erlang&distro=openEuler-24.03-LTS-SP3",
            "ecosystem": "openEuler:24.03-LTS-SP3"
          },
          "database_specific": {
            "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4256.json"
          },
          "ecosystem_specific": {
            "src": [
              "erlang-25.3.2.6-21.oe2403sp3.src.rpm"
            ],
            "x86_64": [
              "erlang-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-asn1-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-common_test-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-compiler-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-crypto-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-debugger-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-debuginfo-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-debugsource-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-dialyzer-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-diameter-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-edoc-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-eldap-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-erl_docgen-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-erl_interface-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-erts-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-et-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-eunit-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-examples-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-ftp-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-inets-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-jinterface-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-kernel-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-megaco-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-mnesia-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-observer-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-odbc-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-os_mon-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-parsetools-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-public_key-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-reltool-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-runtime_tools-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-sasl-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-snmp-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-src-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-ssh-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-ssl-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-stdlib-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-syntax_tools-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-tftp-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-tools-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-wx-25.3.2.6-21.oe2403sp3.x86_64.rpm",
              "erlang-xmerl-25.3.2.6-21.oe2403sp3.x86_64.rpm"
            ],
            "aarch64": [
              "erlang-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-asn1-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-common_test-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-compiler-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-crypto-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-debugger-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-debuginfo-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-debugsource-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-dialyzer-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-diameter-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-edoc-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-eldap-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-erl_docgen-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-erl_interface-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-erts-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-et-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-eunit-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-examples-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-ftp-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-inets-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-jinterface-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-kernel-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-megaco-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-mnesia-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-observer-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-odbc-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-os_mon-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-parsetools-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-public_key-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-reltool-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-runtime_tools-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-sasl-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-snmp-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-src-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-ssh-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-ssl-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-stdlib-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-syntax_tools-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-tftp-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-tools-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-wx-25.3.2.6-21.oe2403sp3.aarch64.rpm",
              "erlang-xmerl-25.3.2.6-21.oe2403sp3.aarch64.rpm"
            ]
          }
        }
      ],
      "modified": "2026-10-16T12:15:06.645432959Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-65634",
        "CVE-2026-68956",
        "CVE-2026-89422"
      ],
      "references": [
        "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4256",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-65634",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-68956",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-89422"
      ],
      "provider_metadata": {
        "severity": "Critical"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-65634",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-68956",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-89422",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 340772,
  "published_at": "2026-10-16T11:58:39+00:00"
}