CVE-2026-55737: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-55737 is a Signed-to-Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP's erts (Erlang Runtime System) that allows an unauthenticated attacker to crash the BEAM virtual machine by supplying a crafted Erlang External Term Format (ETF) binary to binary_to_term/1. It was published on July 27, 2026, and affects OTP versions 25.0 through 29.0.3, 28.0 through 28.5.0.3, and 25.0 through 27.3.4.14 (corresponding to erts 13.0 through 17.0.3, 16.0 through 16.4.0.3, and 13.0 through 15.2.7.10). The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a signed/unsigned integer mismatch (CWE-195) in erts/emulator/beam/external.c that leads to an out-of-bounds write (CWE-787). The validation function decoded_size() reads the 32-bit arity field of a LARGE_TUPLE_EXT term using get_uint32() (unsigned), while the decoding function dec_term() reads the same field using get_int32() (signed). An arity wire value of 0x80000000 passes validation as 2147483648 but is interpreted as -2147483648 during decoding, causing the heap pointer hp += n to move backward into invalid memory. Neither pass enforces the MAX_ARITYVAL runtime limit, resulting in an out-of-bounds heap write; the BEAM VM detects the impossible heap state and aborts. The attack payload can be delivered as a compressed ETF binary, making it compact on the wire. The fix, committed in c5210b4, adds a bounds check in decoded_size() rejecting tuples larger than ERTS_MAX_TUPLE_SIZE (16,777,215) (GitHub Commit, GitHub Advisory).

Successful exploitation results in a crash of the Erlang BEAM virtual machine, causing a complete denial of service for any application running on the affected OTP instance. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Any Erlang-based service that passes untrusted or attacker-controlled data to binary_to_term/1 is at risk, which can include distributed systems, message brokers, and web services built on frameworks like Phoenix/Cowboy (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.126%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, though the network-accessible attack vector and lack of authentication requirements lower the barrier for exploitation in exposed deployments.

1. Identify a target: Locate an Erlang/OTP application (OTP 25.0–29.0.3) that accepts external input and passes it to binary_to_term/1 — common in distributed Erlang nodes, RabbitMQ, or custom ETF-based APIs.
2. Craft the malicious ETF payload: Construct a LARGE_TUPLE_EXT binary with the 4-byte arity field set to 0x80000000. This value passes the unsigned validation check but decodes as -2147483648 in the signed decode pass.
3. Compress the payload: Wrap the crafted ETF binary in a compressed ETF envelope (using the 131, 80 tag prefix and zlib compression) to reduce the payload size on the wire, making delivery practical.
4. Deliver the payload: Send the compressed ETF binary to the target application via any interface that feeds data into binary_to_term/1 — for example, a network socket, HTTP endpoint, or Erlang distribution protocol message.
5. Trigger VM crash: The BEAM runtime processes the payload, dec_term() reads the arity as -2147483648, moves the heap pointer backward, triggers an out-of-bounds write, detects an impossible heap state, and aborts the VM — resulting in denial of service (GitHub Advisory, Red Hat Bugzilla).

• Logs: Unexpected BEAM VM crash logs or erl_crash.dump files generated on the host; application supervisor logs showing repeated restarts of Erlang processes.
• File System: Presence of erl_crash.dump files in the working directory of the Erlang application, which are generated automatically on VM abort.
• Process: Sudden termination of the beam.smp or beam OS process without a graceful shutdown signal; repeated process restarts by an init system (e.g., systemd) for Erlang-based services.
• Network: Unusual or malformed binary data sent to ports or sockets consumed by Erlang applications, particularly short compressed payloads (due to compressed ETF) followed by service unavailability.

Upgrade to one of the patched Erlang/OTP versions: OTP 29.0.4, OTP 28.5.0.4, or OTP 27.3.4.15 (corresponding to erts 17.0.4, 16.4.0.4, and 15.2.7.11 respectively). No workarounds are known according to the official advisory. As a defense-in-depth measure, restrict network access to systems running affected Erlang versions and avoid passing untrusted external data directly to binary_to_term/1 without prior validation (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was responsibly disclosed by Nick Gunn (nick@ausimian.net) and credited in the official GitHub Security Advisory. Red Hat has tracked the issue as high severity in their Bugzilla system. Microsoft has also acknowledged the vulnerability in their Security Response Center update guide. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking and scanner updates from Tenable (Nessus plugins 330409 and 331348) (GitHub Advisory, Microsoft, Red Hat Bugzilla).