FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Erlang/OTP -- remote crash via gen_tcp with {packet,4}

Affected packages
erlang < 28.5.0.6,4
erlang-runtime27 < 27.3.4.17
erlang-runtime28 < 28.5.0.6
erlang-runtime29 < 29.0.6

Details

VuXML ID 62b56853-a609-11f1-9195-4c526214c986
Discovery 2026-09-01
Entry 2026-09-01

The OTP 29.0.6 release notes report:

A gen_tcp socket using the inet driver and {packet,4} had a bug if receiving a packet with size just below INT_MAX.

That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash.

This made it possible for anyone to remotely crash an Erlang node that used {packet,4} on a reachable socket.

References

CVE Name CVE-2026-75538
URL https://github.com/erlang/otp/releases/tag/OTP-27.3.4.17
URL https://github.com/erlang/otp/releases/tag/OTP-28.5.0.6
URL https://github.com/erlang/otp/releases/tag/OTP-29.0.6
URL https://github.com/erlang/otp/security/advisories/GHSA-8m6r-2pj2-25pm