BSD PortsErlang/OTP -- buffer overflow parsing SCTP ERROR/ABORT chunks
· CVE-2026-49759 · VuXML entry
https://github.com/erlang/otp/security/advisories/GHSA-6f4f-chj5-5g97 reports: A buffer overflow error when parsing SCTP ERROR or ABORT chunks has been fixed. This could lead to stack corruption and VM crash, but ultimately with hard work by an attacker be refined into maybe even remote code execution.
Affected versions
- erlang-runtime27 < 27.3.4.13
- erlang-runtime28 < 28.5.0.2
- erlang-runtime29 < 29.0.2
By system
2 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/erlang-runtime27 | 27.3.4 | vulnerable since 2026-06-10 | |
| FreeBSD | lang/erlang-runtime27 | 27.3.4.19_1 | fixed | (48 days after) |
| DragonFly | lang/erlang-runtime28 | 28.0 | vulnerable since 2026-06-10 | |
| MidnightBSD | lang/erlang-runtime28 | 28.5.0.8 | out of range, by version | |
| FreeBSD | lang/erlang-runtime28 | 28.5.0.8_1 | fixed | (48 days after) |
| FreeBSD | lang/erlang-runtime29 | 29.1.2_1 | fixed | (23 days after) |