USN-8895-2: Sudo vulnerability
USN-8895-2
Summary
It was discovered that the Erlang Port Mapper Daemon did not properly handle slow connections. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-42792)
It was discovered that Erlang incorrectly handled certain external term format data, leading to heap corruption. An attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-55737)
It was discovered that Erlang incorrectly handled invalid external term format data. An attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-54890)
It was discovered that Erlang incorrectly handled certain packet lengths, leading to a buffer overflow. A remote attacker could possibly use this issue to cause Erlang to crash or execute arbitrary code. (CVE-2026-75538)
It was discovered that the Erlang Megaco flex scanner incorrectly handled certain input, leading to a buffer overflow. A remote attacker could possibly use this issue to cause Erlang to crash or execute arbitrary code. (CVE-2026-59250)
It was discovered that Erlang TLS clients incorrectly accepted cipher suites that they had not offered. A remote attacker could possibly use this issue to intercept and modify TLS communications. (CVE-2026-55953)
It was discovered that Erlang incorrectly handled certain certificate chains. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-58227)
It was discovered that Erlang incorrectly handled certain certificate policies. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59251)
It was discovered that the Erlang HTTP server incorrectly handled certain conflicting HTTP framing headers. A remote attacker could possibly use this issue to smuggle HTTP requests. (CVE-2026-23941, CVE-2026-73812)
It was discovered that the Erlang HTTP server incorrectly handled certain malformed chunk sizes. A remote attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service. (CVE-2026-6
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 18
Updates
- Published by Ubuntu
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.