BSD PortsErlang/OTP -- remote crash via gen_tcp with {packet,4}
· CVE-2026-75538 · VuXML entry
The OTP 29.0.6 release notes report: A gen_tcp socket using the inet driver and {packet,4} had a bug if receiving a packet with size just below INT_MAX. That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash. This made it possible for anyone to remotely crash an Erlang node that used {packet,4} on …
Affected versions
- erlang < 28.5.0.6,4
- erlang-runtime27 < 27.3.4.17
- erlang-runtime28 < 28.5.0.6
- erlang-runtime29 < 29.0.6
By system
3 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/erlang | 25.3.2.7_1,4 | vulnerable since 2026-09-01 | |
| NetBSD | lang/erlang | 27.3.4.7 | not listed | |
| MidnightBSD | lang/erlang | 25.3.2.20_1,4 | in range, by version | |
| FreeBSD | lang/erlang | 28.5.0.8_1,4 | fixed | |
| DragonFly | lang/erlang-runtime27 | 27.3.4 | vulnerable since 2026-09-01 | |
| FreeBSD | lang/erlang-runtime27 | 27.3.4.19_1 | fixed | |
| DragonFly | lang/erlang-runtime28 | 28.0 | vulnerable since 2026-09-01 | |
| MidnightBSD | lang/erlang-runtime28 | 28.5.0.8 | out of range, by version | |
| FreeBSD | lang/erlang-runtime28 | 28.5.0.8_1 | fixed | |
| FreeBSD | lang/erlang-runtime29 | 29.1.2_1 | fixed |