CVE-2026-49759: Erlang OTP SCTP Buffer Overflow Denial of Service

Technical summary

The vulnerability resides in the sctp_parse_error_chunk function within erts/emulator/drivers/common/inet_drv.c. This function parses SCTP ERROR chunks and writes cause codes into a stack-allocated ErlDrvTermData spec[] array without bounds checking. An attacker with an established SCTP association to a listening Erlang node can craft an ERROR chunk containing a large number of cause codes; each cause code is a 16-bit value interleaved with a fixed tag. When the function iterates through these codes and writes them to the fixed-size spec array, the stack buffer overflows. Because the attacker can only write 16-bit values in a fixed pattern, they cannot control the return address; exploitation is limited to crashing the process. The overflow may also leak fragments of VM memory that are returned in the error packet, but this data is not privileged—it is already readable by the Erlang process owner.

Business impact

Erlang-based services lose availability when an attacker triggers this vulnerability. Since the BEAM VM crash is triggered by a single crafted SCTP packet, an attacker can repeatedly cause denial of service with minimal effort. Erlang is used in telecommunications, real-time messaging systems, and distributed computing platforms where uptime is critical. Repeated crashes degrade service quality, trigger failover events, and may incur operational cost. The memory disclosure component is low-risk in most deployments since it only exposes data already visible to the VM process owner, but in multi-tenant or security-sensitive environments, any unintended memory leakage should be remediated.

Affected systems

This vulnerability affects OTP versions 17.0 through 27.3.4.12, 28.5.0.1, and 29.0.1. Users running any Erlang OTP release before version 27.3.4.13, 28.5.0.2, or 29.0.2 are at risk if their application uses SCTP or if SCTP is enabled on the node. The corresponding erts (Erlang RunTime System) versions are 6.0 through 15.2.7.8, 16.4.0.1, and 17.0.1. Deployments that do not use SCTP (and have it disabled) are not affected. Systems that are not exposed to untrusted SCTP traffic on the network are at lower risk, though network-adjacent attackers or compromised hosts on the same network segment can exploit this vulnerability.

Exploitability

Exploitability is straightforward from a technical perspective: the attacker needs only network access to an SCTP port on which Erlang is listening and must be able to establish an SCTP association. They then send a single malformed ERROR chunk. No authentication is required. The CVSS score of 8.2 (HIGH) reflects the ease of exploitation (network-accessible, no authentication, low complexity) balanced against the limitation that exploitation results in denial of service rather than code execution. The attack is not in any known exploited vulnerabilities (KEV) catalog as of the last update, but the low barrier to entry suggests the risk of weaponization is real. Organizations using SCTP in untrusted network environments or on internet-facing nodes should prioritize patching.

Remediation

Update Erlang OTP to version 27.3.4.13 or later, 28.5.0.2 or later, or 29.0.2 or later. The fix involves bounds checking in the sctp_parse_error_chunk function to ensure that cause codes do not overflow the spec array. Patching should be tested in a staging environment to confirm compatibility with running Erlang applications. In environments where immediate patching is not possible, consider disabling SCTP at the network or firewall level if the application does not require it, or restrict SCTP access to trusted hosts only. Verify patch application by confirming the erts version matches the expected release (15.2.7.9 or later, 16.4.0.2 or later, or 17.0.2 or later).

Patch guidance

Erlang OTP updates are released as distinct versions. Identify your current OTP version with erl -v. Consult the official Erlang release notes to confirm the correct target version for your release series. Test patches in a non-production environment first, particularly if your application relies on SCTP or has complex networking configurations. Rolling upgrades should be coordinated with your cluster's failover and load-balancing strategy to maintain service availability. After patching, verify the new erts version and confirm that SCTP functionality (if used) continues to operate normally.

Detection guidance

Monitor for sudden, unexplained BEAM VM crashes on nodes that accept SCTP traffic. Enable detailed SCTP logging and network monitoring on nodes exposed to untrusted SCTP sources. Intrusion detection systems can flag SCTP packets with unusually large ERROR chunks or malformed cause codes, though signature-based detection may be limited by protocol complexity. Application-level monitoring should track VM restart frequency and trigger alerts on anomalous crash patterns. If SCTP is not in use, auditing to confirm it is disabled provides a strong assurance that this vulnerability cannot be exploited.

Why prioritize this

This vulnerability merits high priority due to its network accessibility, ease of exploitation, and impact on availability. The CVSS 8.2 score and the lack of any mitigating factors (no authentication required, no user interaction) place it in the category of critical operational risk. Organizations running Erlang in production should treat this as a priority patch. However, the scope is limited to deployments that use SCTP; organizations that do not rely on SCTP can deprioritize if network segmentation is already in place to block SCTP traffic.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction needed (UI:N), and a scope of unchanged (S:U). The confidentiality impact is low (C:L) due to limited memory disclosure, but the availability impact is high (A:H) because the VM crash completely denies service. The integrity impact is none (I:N) since the overflow does not enable data modification or code execution. This translates to a HIGH severity rating.

Frequently asked questions