Stay Secure with the Latest Linux Advisories

security advisorydenial of servicefedora

Fedora 44 Erlang Important Denial Of Service Auth Bypass CVE-2026-48858

Backport fixes for CVE-2026-48858 (ftp SSRF), CVE-2026-49759 (SCTP DoS), CVE-2026-48860 (dist-over-TLS auth bypass), CVE-2026-54886 (ssh SFTP DoS), CVE-2026-54891 (TLS handshake data injection), and CVE-2026-55952 (TLS 1.3 session ticket DoS). These are fixed upstream in OTP 27.x (rawhide/f45); backported here to the OTP 26.x line.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-dcf80dc1ff 2026-07-19 05:46:37.002185+00:00 -------------------------------------------------------------------------------- Name : erlang Product : Fedora 44 Version : 26.2.5.21 Release : 4.fc44 URL : https://www.erlang.org Summary : General-purpose programming language and runtime environment Description : Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. -------------------------------------------------------------------------------- Update Information: Backport fixes for CVE-2026-48858 (ftp SSRF), CVE-2026-49759 (SCTP DoS), CVE-2026-48860 (dist-over-TLS auth bypass), CVE-2026-54886 (ssh SFTP DoS), CVE-2026-54891 (TLS handshake data injection), and CVE-2026-55952 (TLS 1.3 session ticket DoS). These are fixed upstream in OTP 27.x (rawhide/f45); backported here to the OTP 26.x line. -------------------------------------------------------------------------------- ChangeLog: * Fri Jul 10 2026 Peter Lemenkov - 26.2.5.21-4 - Backport fix for CVE-2026-48858, CVE-2026-48860, CVE-2026-49759, CVE-2026-54886, CVE-2026-54891, CVE-2026-55952 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2489554 - CVE-2026-48858 erlang: Erlang/OTP ftp: Server-Side Request Forgery (SSRF) via unvalidated PASV response IP address [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2489554 [ 2 ] Bug #2490026 - CVE-2026-49759 erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2490026 [ 3 ] Bug #2490272 - CVE-2026-48860 erlang: Erlang/OTP: Authentication bypass allows arbitrary code execution via improper IP address validation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2490272 [ 4 ] Bug #2496748 - CVE-2026-54891 erlang: Erlang SSL: Unauthenticated data injection during TLS handshake [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2496748 [ 5 ] Bug #2496790 - CVE-2026-54886 erlang: Erlang OTP ssh: Denial of Service via infinite loop in SFTP channel [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2496790 [ 6 ] Bug #2496798 - CVE-2026-55952 erlang: Erlang/OTP: Denial of Service in TLS 1.3 session ticket handling [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2496798 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-dcf80dc1ff' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new . Backporting critical fixes for Erlang vulnerabilities in Fedora 44 enhances system security against various attacks.. Erlang Security, Fedora Update, DoS Protection, Authentication Issues, SSRF Fixes. . Severity: Important. LinuxSecurity.com Team

Jul 19, 2026 •Important Fedora