CVE-2026-55737: 
CBL Mariner Schwachstellenanalyse und -minderung

CVE-2026-55737 is a Signed-to-Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP's erts (Erlang Runtime System) component, specifically in the binary_to_term/1 function. It allows an unauthenticated attacker who can supply a crafted Erlang External Term Format (ETF) binary to corrupt the BEAM heap pointer and crash the virtual machine, resulting in a denial of service. Affected versions span OTP 25.0 through versions before OTP 29.0.4, 28.5.0.4, and 27.3.4.15 (corresponding to erts 13.0 through versions before 17.0.4, 16.4.0.4, and 15.2.7.11). The vulnerability was published on July 27, 2026, and was responsibly disclosed by Nick Gunn. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a signed/unsigned integer type mismatch (CWE-195) leading to an out-of-bounds write (CWE-787) in erts/emulator/beam/external.c. During ETF decoding of a LARGE_TUPLE_EXT term, the validation pass decoded_size() reads the 32-bit arity field as an unsigned integer via get_uint32(), while the decode pass dec_term() reads the same field as a signed 32-bit integer via get_int32(). An arity wire value of 0x80000000 passes validation as 2147483648 but is interpreted as -2147483648 in the decode pass, causing the heap pointer (hp += n) to move backward into invalid memory. Neither pass enforced the runtime tuple-arity limit MAX_ARITYVAL. The fix (commit c5210b4) adds a bounds check in decoded_size() rejecting tuples larger than ERTS_MAX_TUPLE_SIZE (16,777,215), and adds an assertion in dec_term(). The attack can be delivered as a compact compressed-ETF payload, reducing the wire size significantly (GitHub Advisory, Fix Commit).

Successful exploitation causes the BEAM virtual machine to detect an impossible heap state and abort, resulting in a complete denial of service for any application running on the affected Erlang OTP runtime. There is no known confidentiality or integrity impact — the vulnerability is limited to availability. Any Erlang/OTP-based service that passes untrusted or attacker-controlled binary data to binary_to_term/1 is at risk, which includes distributed Erlang nodes, message brokers (e.g., RabbitMQ), and custom protocol handlers (GitHub Advisory, Red Hat Bugzilla).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.00126 (very low probability of exploitation in the near term). The NVD SSVC assessment classifies the vulnerability as non-automatable with partial technical impact, further reducing near-term exploitation risk (GitHub Advisory).

1. Identify a target: Locate an Erlang/OTP-based service (e.g., RabbitMQ, a custom Erlang application) running an affected OTP version (25.0 through pre-29.0.4/28.5.0.4/27.3.4.15) that accepts untrusted binary data and passes it to binary_to_term/1.
2. Craft the malicious ETF payload: Construct a LARGE_TUPLE_EXT ETF binary with the 32-bit arity field set to 0x80000000. This value passes the unsigned validation check but is interpreted as -2147483648 in the signed decode pass.
3. Compress the payload: Wrap the crafted ETF binary in a compressed-ETF envelope (using zlib compression) to reduce the wire payload size, making delivery practical.
4. Deliver the payload: Submit the crafted binary to the target service through any interface that feeds data into binary_to_term/1 — for example, a network protocol endpoint, a message queue, or an API accepting serialized Erlang terms.
5. Trigger the crash: The BEAM VM's dec_term() function moves the heap pointer backward by ~2 billion words, causing an out-of-bounds heap write. The VM detects the impossible heap state and aborts, crashing the service (GitHub Advisory, Fix Commit).

• Logs: Unexpected BEAM VM crash logs or core dumps with messages indicating an impossible heap size or memory abort; Erlang crash dump files (erl_crash.dump) generated without an obvious application-level cause.
• Process: Sudden termination of the Erlang/OTP beam.smp process; supervisor restarts logged in application logs immediately following receipt of binary data from an external source.
• Network: Unusual or malformed binary payloads delivered to Erlang distribution ports or application-layer endpoints that accept ETF-encoded data; compressed ETF messages with anomalously small size but triggering VM crashes upon deserialization.
• File System: Presence of erl_crash.dump files in the working directory of the Erlang application, timestamped around the time of suspected exploitation attempts.

Upgrade Erlang OTP to one of the patched versions: OTP 29.0.4, OTP 28.5.0.4, or OTP 27.3.4.15 (corresponding to erts 17.0.4, 16.4.0.4, or 15.2.7.11 respectively). No official workarounds are known; the advisory explicitly states none exist. As a compensating control, restrict or validate all ETF binary inputs passed to binary_to_term/1 from untrusted sources, or avoid calling binary_to_term/1 on attacker-controlled data until patching is complete (GitHub Advisory, Fix Commit).

The vulnerability was responsibly disclosed by Nick Gunn (nick@ausimian.net) to the Erlang/OTP project and was assigned a Moderate severity rating by the Erlang Ecosystem Foundation (EEF), which acted as the CNA. Red Hat triaged the issue as high priority/severity in their Bugzilla tracker. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation (GitHub Advisory, Red Hat Bugzilla).