Your message dated Sat, 24 Oct 2026 11:49:55 +0000
with message-id <[email protected]>
and subject line Bug#1151684: fixed in erlang 1:29.1.2+dfsg-1
has caused the Debian Bug report #1151684,
regarding erlang: CVE-2026-94200 CVE-2026-96596 CVE-2026-105236
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151684: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151684
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: erlang
Version: 1:29.1.1+dfsg-1
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security upstream
Hi,
The following vulnerabilities were published for erlang.
CVE-2026-94200[0]:
| Improper Validation of Consistency within Input vulnerability in
| Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and
| tls_client_ticket_store modules) allows a malicious TLS 1.3 server
| to cause a denial of service of the ssl application on the client
| node. The TLS 1.3 client decodes the extensions of a
| NewSessionTicket message as if they came from EncryptedExtensions.
| It therefore accepts a 0-length early_data extension, a form that is
| only valid in ClientHello and EncryptedExtensions. With
| {session_tickets, auto}, the client stores the ticket in the node-
| global tls_client_ticket_store. On the next automatic resumption,
| tls_handshake_1_3:get_max_early_data/1 crashes the store with a
| case_clause. Repeated crashes can exceed the restart intensity of
| the ssl supervisors, which use the rest_for_one strategy, and take
| down ssl for all connections on the node. This issue affects OTP
| from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2,
| corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and
| 11.7.8.
CVE-2026-96596[1]:
| Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability
| in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar
| module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3
| (r3_hex_erl_tar module) allows an attacker who supplies a tar
| archive to cause a denial of service via a crafted GNU sparse
| member. When erl_tar:extract/1,2 writes a member to disk,
| erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by
| default. For a GNU sparse member whose sparse map ends before its
| real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause
| before its zero-length clause. After the chunk is used up, the
| trailing-hole clause reads zero bytes, does not advance the
| position, and recurses forever. A 2048-byte archive keeps the
| extracting process and one scheduler busy until the process is
| killed. The {max_size, N} option prevents this only when N is below
| the real size of the member. Extraction with the memory option is
| not affected. hex_core ships its own copy of erl_tar as
| hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module
| names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the
| same code and do not call stdlib's erl_tar, so they are affected on
| any OTP version. OTP 28 is not affected, but an application running
| on OTP 28 is affected if it extracts archives through an affected
| version of hex_core, Hex or rebar3. This issue affects OTP from
| OTP 29.0 before OTP 29.1.2, corresponding to rebar3 from 3.27.1
| before 3.28.0, and stdlib from 8.0 before 8.1.1, and hex from 2.4.2
| before 2.5.3; hex_core: from 0.14.0 before 0.20.1.
CVE-2026-105236[2]:
| Improper Certificate Validation vulnerability in the ssl application
| in Erlang/OTP allows a client that holds a certificate trusted by
| one SNI virtual host to authenticate to a second SNI virtual host on
| the same listener by resuming its TLS 1.2 session there. A server
| that serves several SNI names from one listen socket through sni_fun
| or sni_hosts keeps one pre-TLS 1.3 session cache per listener and
| does not bind a cached session to the SNI name or client trust
| policy that established it. When an SNI option set switches to
| verify_peer without naming reuse_sessions,
| ssl_config:update_options/3 inherits the base listener's
| reuse_sessions value of true, so the default that disables reuse for
| client-authenticating servers does not apply. On an abbreviated
| handshake ssl_session:is_resumable/4 checks only that the cached
| session uses one of the current server certificates and carries some
| peer certificate, and never revalidates that certificate against the
| CA selected for the requested name. The names must share a server
| certificate, which is common with wildcard or multi-SAN
| certificates. TLS 1.3 does not use this cache and is not affected.
| This issue affects OTP from OTP 18.0 before OTP 27.3.4.19,
| OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 7.0 before
| 11.2.12.14, 11.6.0.7, and 11.7.8.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-94200
https://www.cve.org/CVERecord?id=CVE-2026-94200
[1] https://security-tracker.debian.org/tracker/CVE-2026-96596
https://www.cve.org/CVERecord?id=CVE-2026-96596
[2] https://security-tracker.debian.org/tracker/CVE-2026-105236
https://www.cve.org/CVERecord?id=CVE-2026-105236
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: erlang
Source-Version: 1:29.1.2+dfsg-1
Done: Sergei Golovan <[email protected]>
We believe that the bug you reported is fixed in the latest version of
erlang, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sergei Golovan <[email protected]> (supplier of updated erlang package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 14:15:44 +0300
Source: erlang
Architecture: source
Version: 1:29.1.2+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Erlang Packagers <[email protected]>
Changed-By: Sergei Golovan <[email protected]>
Closes: 1151684
Changes:
erlang (1:29.1.2+dfsg-1) unstable; urgency=medium
.
* New upstream release.
- Fix CVE-2026-94200: Improper Validation of Consistency within Input
vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and
tls_client_ticket_store modules) allows a malicious TLS 1.3 server
to cause a denial of service of the ssl application on the client node.
- Fix CVE-2026-96596: Loop with Unreachable Exit Condition ('Infinite
Loop') vulnerability in Erlang OTP stdlib (erl_tar module) allows
an attacker who supplies a tar archive to cause a denial of service
via a crafted GNU sparse member.
- Fix CVE-2026-105236: Improper Certificate Validation vulnerability
in the ssl application in Erlang/OTP allows a client that holds
a certificate trusted by one SNI virtual host to authenticate
to a second SNI virtual host on the same listener by resuming
its TLS 1.2 session there.
Closes: #1151684.
Checksums-Sha1:
b23cd99e0f508cd9a2bad77d8d06d9919927437a 5048 erlang_29.1.2+dfsg-1.dsc
6784dbd6b6f4ce38380d47f24873ea9d879c3709 49389056
erlang_29.1.2+dfsg.orig.tar.xz
9d220fcdb66771f26a2e67a8676b181b7f698672 64240
erlang_29.1.2+dfsg-1.debian.tar.xz
1279f1395b8458ad6b6f9eb4b252fabc20507a04 32273
erlang_29.1.2+dfsg-1_amd64.buildinfo
Checksums-Sha256:
25ad94ee185652c436b9bf2f60077a9a94832401f47e342ddf0b677f7788fcda 5048
erlang_29.1.2+dfsg-1.dsc
f0d2090af6f9f94df94c71dfeb392b1988d02655e9d31ce961f1de79986cca27 49389056
erlang_29.1.2+dfsg.orig.tar.xz
fa41666f64be1b7eccace79fcdb110cf6f6714eac8561cfaa9902212ffcbb07c 64240
erlang_29.1.2+dfsg-1.debian.tar.xz
1b37537f5102f2321914f7ee0da87ee4d547170761efa2d49259fe7525bd9c28 32273
erlang_29.1.2+dfsg-1_amd64.buildinfo
Files:
494d2812c1ad636c598ce2e6c3b34cd3 5048 interpreters optional
erlang_29.1.2+dfsg-1.dsc
78ef36690439d8d896de9318c598fb52 49389056 interpreters optional
erlang_29.1.2+dfsg.orig.tar.xz
4d906ff15e35282cedf0d0a1d3e55cab 64240 interpreters optional
erlang_29.1.2+dfsg-1.debian.tar.xz
68183aa54238eed5ad30e5666342e596 32273 interpreters optional
erlang_29.1.2+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/SYPsyDB+ShSnvc4Tyrk60tj54cFAmrclWgACgkQTyrk60tj
54dfKw/+JjHCUHjuUjBSVXTz1M1Wi7qbK6YZFDzD+7Q0264bMKuOSgW3DPxSXqX0
I2U2b3msRrAyblnYqvnaTCGNCXjYewerL906OCnDJfcjnxnwu7uG+fwwIgdENtul
++/EsCkV6hvS2vsR2vnVK+QKgNvTlaAu+ZdAko0Gp26A/sSl/lEhZ34xee6YSkmQ
GwhfP6djI/lzzQFH0kkbUHzl24n3V5vv6v1xD6bJb+bh71t2K7fhoVKMTT447nn+
F/fQMxTMxBaCSoBH+XhYcts7MMHSvsIITD8WKutFz3BAt+huShVatOh3e0rXvusx
vE4Txne6WvLc02/1pcc8W0AhPsgcTbfVH+1drKE5nB3YLhCoViDJaS2xWj4BmMSF
eEM4goVb2msgvAZp598sw/Xymru+cTbnV0WWx0Jyl2RhaN2n6OBXLW0E6TDgJd4u
mIXW5GEiRg7cG3gIox8XeMFhpFYWDcvxsqG2bVUK9Jk4DpPFaVUjNWwBYgpsZoET
DKqb/NODw4lDXb7xMDdt6Qu3VIXUJdIRc9WSfAxB10ri8tIhcIbn4ZsPzAn38PKa
E6aoI6CHorrTLhiqx/rdDDIJDETR/tMYWwaxuBgtisy4D3jJoe7D7q8635t93YQc
z9cjAQ8AOeta0lO5qtNBU2JOx/QLi4NyE39L6DwwjVaMgdfNsc8=
=66o3
-----END PGP SIGNATURE-----
pgp9gvOn_C_cy.pgp
Description: PGP signature
--- End Message ---
