CVE-2026-54890

CVE-2026-54890 is a heap underflow vulnerability in the BIT_BINARY_EXT (tag 77) parser within Erlang/OTP's distribution protocol. The bug triggers a VM-level abort rather than a process-level exception—and that distinction is the most important thing to understand about this vulnerability. Patches are available in Erlang/OTP 29.0.4, 28.5.0.4, and 27.3.4.15. If you run any of these versions in production, you should upgrade immediately. Here's what makes this severe despite a low EPSS score: a single malformed ETF packet received over the distribution protocol triggers a VM abort that terminates the entire node. Not the process. The node. In an Erlang cluster, this means one malformed packet can collapse your entire supervision tree across all connected nodes—linked processes die, watchers receive 'DOWN' messages, and the cascade propagates outward. This isn't a parsing bug in one process; it's a cluster-wide kill switch reachable over the distribution port. The second critical misunderstanding is the [safe] option in binary_to_term/2. Most developers reaching for this option when handling external input believe it provides structural protection—it doesn't. The [safe] option restricts atom creation to prevent atom table exhaustion attacks (CVE-2011-0769 and related issues), but it performs zero validation of the ETF structure itself. A malformed BIT_BINARY_EXT that triggers the underflow will crash the VM regardless of whether [safe] is used. The option's name creates a dangerous cognitive shortcut: developers see 'safe' and stop investigating. It is not a defense against this vulnerability class. The OTP Secure Coding Guidelines state that the distribution protocol operates on 'trusted networks,' but this assumption increasingly does not reflect modern deployment reality. Kubernetes pods, service meshes, and multi-tenant environments blur network boundaries in ways the original 1990s-era trust model never contemplated. If your Erlang nodes accept distribution traffic from any source you didn't personally provision on an isolated network segment, you may be exposed. The low EPSS score (0.00318) likely reflects that no scanner currently targets Erlang clusters at scale—but this is a dormant vulnerability. The moment someone writes a scanner or an opportunistic worm, the blast radius is architectural: any component that can send ETF to another Erlang node has a one-packet cluster-kill capability. Organizations running long-term support versions should treat this as a ticking exposure window.

Reviewed through automated stages and approved by a human before publication.