← All news

Wednesday 29 July 2026 · Josh Price

New OTP CVE batch: patch to 29.0.4, 28.5.0.4 or 27.3.4.15

Two weeks after July's big round-up, the Erlang Ecosystem Foundation CNA has published another batch: eight Erlang/OTP CVEs on 27 July and two for Cowboy/Cowlib on the 28th. The headline is a critical TLS client authentication bypass in ssl. If your app makes TLS connections (and it does), update OTP.

Erlang/OTP

  • CVE-2026-55953 CRITICAL 9.1: the TLS 1.2 (and earlier) and DTLS client accepts a cipher suite the server selected even if the client never offered it, enabling an algorithm downgrade and adversary-in-the-middle against ssl clients.

  • CVE-2026-58227 HIGH 8.7: TLS/DTLS denial of service via unbounded recursion on a cross-signed peer certificate chain.

  • CVE-2026-59251 HIGH 8.7: public_key DoS via exponential certificate-policy-tree growth during path validation.

  • CVE-2026-59250 HIGH 8.3: Megaco flex scanner buffer overflow via an oversized property parm name.

  • CVE-2026-54890 HIGH 8.2: BEAM VM crash via an integer underflow in binary_to_term BIT_BINARY_EXT decoding, a DoS anywhere you decode untrusted external term format.

  • CVE-2026-42792 MEDIUM 6.3: epmd permanent DoS via file-descriptor exhaustion (EMFILE) on accept(2).

  • CVE-2026-55737 MEDIUM 5.1: heap pointer corruption via a signed/unsigned mismatch in LARGE_TUPLE_EXT decoding.

  • CVE-2026-47078 MEDIUM 4.8: relative path traversal in zip:unzip/1 and zip:extract/1 via a depth-counter bypass in check_dir_level.

    Fix Upgrade Erlang/OTP to 29.0.4, 28.5.0.4, or 27.3.4.15. Same drill as two weeks ago: an OTP upgrade, not a Hex bump.

cowlib

  • CVE-2026-59248 HIGH 8.7: unbounded HPACK/QPACK prefixed-integer decoding, a memory-exhaustion DoS reachable through HTTP/2 and HTTP/3.

    Fix Upgrade cowlib to 2.19.0.

cowboy

  • CVE-2026-65624 MEDIUM 6.9: duplicate header names bypass the HTTP/1.1 max_headers limit, enabling memory exhaustion.

    Fix Upgrade cowboy to 2.18.0. Newer Phoenix apps default to Bandit, but plenty of deployed apps still serve on Cowboy, so check your lockfile.

What to do

  1. Update OTP first: the critical ssl cipher-suite bypass undermines TLS server authentication for every outbound connection your node makes.
  2. Run mix hex.audit for the Cowboy/Cowlib pair, and remember Hex 2.5 flags advisories during mix deps.get (see the Hex 2.5 write-up).
  3. Watch the EEF CNA advisory list. At this cadence it's worth a bookmark.

The pattern from the last batch holds: mostly DoS via unbounded resource use, but the one that isn't (the TLS downgrade) is the one to lose sleep over. Patch that today.