Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-54886 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-53422 | Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of fi | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-49760 | Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with pr | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-49759 | Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a c | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-48860 | Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-ov | erlang erlang erlang erlang |
| CVE | CVE-2026-48858 | Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV r | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-48856 | Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-48855 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_REA | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-42791 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired respo | erlang erlang erlang erlang |
| CVE | CVE-2026-42790 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via s | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-42789 | Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be ac | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-32147 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authentic | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-32144 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via | erlang erlang erlang erlang |
| CVE | CVE-2026-28810 | Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The buil | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-28808 | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when se | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-23943 | Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via R | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-23942 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-21620 | Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tft | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2025-58190 | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (Do | golang-golang-x-net golang-golang-x-net |
| CVE | CVE-2025-47911 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service | golang-golang-x-net golang-golang-x-net |
About
-
Send Feedback to @ubuntu_updates
