{"schemaVersion":3,"id":"SUSE-SU-2026:3579-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for erlang26\n\nThis update for erlang26 fixes the following issues:\n\n- CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726).\n- CVE-2026-42789: `public_key` application accepts non-CA certificates as intermediate issuers and this enables chain\n  forgery (bsc#1266449).\n- CVE-2026-42790: Name constraints and `Subject CommonName` fallback in TLS hostname verification allows for certificate\n  forgery by MITM attacker (bsc#1266466).\n- CVE-2026-42792: permanent `epmd` DoS via connection slot exhaustion due to improper handling of exceptional\n  conditions (bsc#1272908).\n- CVE-2026-47078: relative path traversal in `zip:unzip/zip:extract` via `check_dir_level` depth-counter bypass\n  (bsc#1272909).\n- CVE-2026-48855: SFTP `READLINK` response leaks absolute backend filesystem path when root is configured (bsc#1268139).\n- CVE-2026-48856: `httpc` leaks `Authorization` headers to cross-origin redirect targets (bsc#1268141).\n- CVE-2026-48858: server-side request forgery allows FTP bounce attacks and SSRF via an unvalidated `PASV` response IP\n  address (bsc#1268142).\n- CVE-2026-48860: `ssl` (`inet_tls_dist` module) allows unauthenticated bypass of the distribution-over-TLS LAN\n  allowlist (bsc#1268146).\n- CVE-2026-49759: unbounded stack buffer overflow in SCTP error cause parsing in `inet_drv` (bsc#1268163).\n- CVE-2026-49760: stack buffer overflow in `ei_s_print_term` at very large integer (bsc#1268164).\n- CVE-2026-53422: SFTP `REALPATH` path-existence oracle allows filesystem enumeration outside configured root\n  (bsc#1270245).\n- CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop (bsc#1270246).\n- CVE-2026-54887: use of default cryptographic key allows predictable DTLS cookie computation during the startup window\n  (bsc#1270247).\n- CVE-2026-54891: plaintext injection towards (D)TLS client during handshake (bsc#1270250).\n- CVE-2026-55737: heap pointer corruption via signed/unsigned mismatch in `LARGE_TUPLE_EXTP` decoding in `erts`\n  external term format decoder (bsc#1272910).\n- CVE-2026-55950: time-of-check time-of-use race condition allows an unauthenticated remote attacker to crash all active\n  DTLS sessions on a listener (bsc#1270253).\n- CVE-2026-55952: missing validation allows for DoS of the TLS-1.3 server when clients send a malformed `ClientHello`\n  with mismatched PSK identity and binder list lengths (bsc#1270258).\n- CVE-2026-55953: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server authentication\n  bypass (bsc#1272911).\n- CVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain\n  (bsc#1272913).\n- CVE-2026-59250: `megaco` flex scanner buffer overflow via oversized property parm name (bsc#1272914).\n- CVE-2026-59251: denial of service via exponential certificate policy tree growth in path validation (bsc#1272915).","dates":{"published":"2026-08-11T14:05:54.000Z","modified":"2026-08-12T10:45:06.178Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"erlang26&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7","name":"erlang26","label":"erlang26&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang26&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7","purlType":"rpm","versions":[{"text":"< 26.2.1-150300.7.28.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.2.1-150300.7.28.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang26&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","name":"erlang26","label":"erlang26&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang26&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","purlType":"rpm","versions":[{"text":"< 26.2.1-150300.7.28.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.2.1-150300.7.28.1","eol":null,"hubHref":null},{"vendor":"suse","product":"erlang26&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","name":"erlang26","label":"erlang26&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/erlang26&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 26.2.1-150300.7.28.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.2.1-150300.7.28.1","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263579-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20263579-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1261726","label":"bugzilla.suse.com/1261726","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266449","label":"bugzilla.suse.com/1266449","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266466","label":"bugzilla.suse.com/1266466","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268139","label":"bugzilla.suse.com/1268139","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268141","label":"bugzilla.suse.com/1268141","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268142","label":"bugzilla.suse.com/1268142","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268146","label":"bugzilla.suse.com/1268146","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268163","label":"bugzilla.suse.com/1268163","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268164","label":"bugzilla.suse.com/1268164","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270245","label":"bugzilla.suse.com/1270245","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270246","label":"bugzilla.suse.com/1270246","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270247","label":"bugzilla.suse.com/1270247","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270250","label":"bugzilla.suse.com/1270250","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270253","label":"bugzilla.suse.com/1270253","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1270258","label":"bugzilla.suse.com/1270258","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272908","label":"bugzilla.suse.com/1272908","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272909","label":"bugzilla.suse.com/1272909","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272910","label":"bugzilla.suse.com/1272910","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272911","label":"bugzilla.suse.com/1272911","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272913","label":"bugzilla.suse.com/1272913","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272914","label":"bugzilla.suse.com/1272914","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272915","label":"bugzilla.suse.com/1272915","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28810","label":"www.suse.com/security/cve/CVE-2026-28810","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42789","label":"www.suse.com/security/cve/CVE-2026-42789","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42790","label":"www.suse.com/security/cve/CVE-2026-42790","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42792","label":"www.suse.com/security/cve/CVE-2026-42792","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47078","label":"www.suse.com/security/cve/CVE-2026-47078","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48855","label":"www.suse.com/security/cve/CVE-2026-48855","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48856","label":"www.suse.com/security/cve/CVE-2026-48856","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48858","label":"www.suse.com/security/cve/CVE-2026-48858","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48860","label":"www.suse.com/security/cve/CVE-2026-48860","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49759","label":"www.suse.com/security/cve/CVE-2026-49759","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49760","label":"www.suse.com/security/cve/CVE-2026-49760","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53422","label":"www.suse.com/security/cve/CVE-2026-53422","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54886","label":"www.suse.com/security/cve/CVE-2026-54886","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54887","label":"www.suse.com/security/cve/CVE-2026-54887","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54891","label":"www.suse.com/security/cve/CVE-2026-54891","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55737","label":"www.suse.com/security/cve/CVE-2026-55737","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55950","label":"www.suse.com/security/cve/CVE-2026-55950","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55952","label":"www.suse.com/security/cve/CVE-2026-55952","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55953","label":"www.suse.com/security/cve/CVE-2026-55953","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58227","label":"www.suse.com/security/cve/CVE-2026-58227","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59250","label":"www.suse.com/security/cve/CVE-2026-59250","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59251","label":"www.suse.com/security/cve/CVE-2026-59251","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-28810","CVE-2026-42789","CVE-2026-42790","CVE-2026-42792","CVE-2026-47078","CVE-2026-48855","CVE-2026-48856","CVE-2026-48858","CVE-2026-48860","CVE-2026-49759","CVE-2026-49760","CVE-2026-53422","CVE-2026-54886","CVE-2026-54887","CVE-2026-54891","CVE-2026-55737","CVE-2026-55950","CVE-2026-55952","CVE-2026-55953","CVE-2026-58227","CVE-2026-59250","CVE-2026-59251"],"downstream":[],"duplicates":[],"related":["CVE-2026-28810","CVE-2026-42789","CVE-2026-42790","CVE-2026-42792","CVE-2026-47078","CVE-2026-48855","CVE-2026-48856","CVE-2026-48858","CVE-2026-48860","CVE-2026-49759","CVE-2026-49760","CVE-2026-53422","CVE-2026-54886","CVE-2026-54887","CVE-2026-54891","CVE-2026-55737","CVE-2026-55950","CVE-2026-55952","CVE-2026-55953","CVE-2026-58227","CVE-2026-59250","CVE-2026-59251"]},"timeline":[{"kind":"published","date":"2026-08-11T14:05:54.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-12T10:45:06.178Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T03:27:08.055Z","stale":false,"partial":false}}