An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HErlang Erlang\/otp
APPErlang18.018.0.118.0.218.0.318.118.1.118.1.218.1.318.1.418.1.518.218.2.118.2.218.2.318.2.4+ 48 more
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Memory
CWE
Related vulnerabilities
CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓same product
Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)
CVE-2026-55953CRITICAL9.1same product
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the...
CVE-2022-37026CRITICAL9.8PL ✓same product
Erlang/OTP – obejście uwierzytelniania klienta w SSL/TLS/DTLS
CVE-2026-54890HIGH8.2PL ✓same product
Integer Underflow w dekoderze ETF Erlang/OTP — DoS przez abort węzła
CVE-2026-58227HIGH8.7PL ✓same product
Erlang/OTP TLS/DTLS: nieskończona rekurencja przy cross-signed certyfikatach (DoS)