CVE-2026-49759

Executive Summary

CVE-2026-49759 is a stack-based buffer overflow in the Erlang OTP inet_drv SCTP error cause parser, enabling an unauthenticated remote attacker to crash the BEAM virtual machine by sending a single crafted SCTP ERROR chunk to an open SCTP socket. Affecting OTP versions from 17.0 through the 27.x, 28.5.x, and 29.0.x branches prior to the patched releases, this vulnerability achieves a CVSS score of 8.8 (High) with network attack vector, no authentication, and high availability impact. While the overflow is constrained to writing 16-bit cause codes interleaved with a fixed tag (preventing arbitrary code execution), it permits reliable denial of service against any Erlang node accepting SCTP connections.

Technical Analysis

The vulnerability resides in erts/emulator/drivers/common/inet_drv.c, specifically in the sctp_parse_error_chunk function. This function processes SCTP ERROR chunks (type 0x09) received over an established SCTP association. SCTP ERROR chunks contain one or more "cause parameters," each beginning with a 16-bit cause code followed by a 16-bit length field, followed by cause-specific data.

The parser iterates over the cause codes contained in the chunk and writes each into a fixed-size, stack-allocated array declared as ErlDrvTermData spec[]. The exact size of this array is implementation-defined but is a small compile-time constant. The loop that processes incoming cause codes does not perform a bounds check against the size of spec[] before writing. When a remote peer sends an SCTP ERROR chunk containing more cause code entries than the spec[] array can hold, the loop writes beyond the array's boundaries, corrupting adjacent stack memory.

Critically, the data written is not attacker-controlled in an arbitrary fashion. Each write consists of a 16-bit cause code value (derived from the network packet) interleaved with a fixed ERL_DRV_TERM tag constant (used by the Erlang driver interface). This constrains the overflow to alternating 16-bit attacker-influenced words and fixed 32-bit (or pointer-sized) tag values. As a result:

1. No controlled return address: The fixed tag values prevent the attacker from precisely overwriting a return address with an arbitrary pointer.
2. Reliable crash: The abundance of writes beyond the stack bounds will almost certainly corrupt stack metadata (saved frame pointers, saved registers, return addresses) leading to a segmentation fault or undefined behavior, crashing the BEAM VM process.
3. Potential memory disclosure: Because the parser may read beyond the bounds of the incoming SCTP packet buffer when interpreting malformed cause lengths, portions of kernel or VM heap memory can be copied into the error packet delivered to the Erlang process. This discloses only data accessible to the same OS user account, limiting its value.

Attack surface: The vulnerable code is reachable only when the Erlang node has SCTP sockets opened ({sctp, true} option) and the SCTP kernel module is loaded. The attacker must complete an SCTP four-way handshake (INIT/INIT-ACK/COOKIE-ECHO/COOKIE-ACK) to the target's SCTP port before sending the malicious ERROR chunk. SCTP is connection-oriented, so a listening socket is required.

Exploitation Scenarios

Step 1 — Target discovery and reconnaissance. An attacker scans for Erlang distribution ports (default TCP 4369 for EPMD) or known SCTP application ports. Erlang distributions commonly use SCTP for inter-node communication in clustered deployments (-proto_dist inet_sctp). Shodan/Censys queries can identify hosts exposing SCTP services, and banner grabbing over TCP 4369 reveals Erlang node names and distribution versions.

Step 2 — Establish SCTP association. Using a tool such as sctp_test (Linux lksctp-tools), a custom Python script with the sctp module, or a crafted packet injector (Scapy with SCTP support), the attacker performs the four-way handshake to the target's SCTP port. No authentication or session credentials are required.

Step 3 — Craft and send the malicious ERROR chunk. Within the established association, the attacker constructs an SCTP ERROR chunk (chunk type 0x09) containing a large number of cause parameter entries — far exceeding the spec[] array capacity (typically dozens to hundreds of causes). Each cause parameter uses a valid cause code (e.g., 0x0005 "Unrecognized Chunk Type") and a minimal 4-byte length (2-byte length field = 4). The chunk is a single SCTP packet; no fragmentation is needed if the victim's PMTU allows a large enough packet (typical SCTP max is 64KB).

Step 4 — Trigger overflow and crash. The sctp_parse_error_chunk function processes the cause codes in a loop, writing each into the fixed spec[] stack buffer. With sufficient causes, the buffer overflows, corrupting the stack. The BEAM VM terminates with a SIGSEGV or SIGABRT, taking down all applications and processes hosted on that node.

Step 5 — Post-exploitation impact. In a clustered Erlang deployment, other nodes detect the failure and may retry connections, consuming resources. Supervisors in other nodes may attempt restarts, but each restart is vulnerable to immediate re-exploitation. The attacker can repeat the attack to maintain prolonged outage. The DoS is remote, unauthenticated, and requires only a single packet.

(Note: No public exploit code exists as of this report; the attack chain above is derived from the vulnerability class and SCTP protocol semantics.)

Impact Assessment

Business impact: High availability impact (CVSS A:H). Any Erlang/OTP-based service exposing SCTP — including but not limited to: MQTT brokers, telecom UCP/TCAP gateways, distributed database nodes, RabbitMQ with SCTP transport, and custom clustered applications — is at risk of remote unauthenticated crash. In a clustered topology, a single crash can cascade into split-brain conditions, data replication stalls, or failover storms.

Confidentiality impact: Low (CVSS C:L). The stack overflow may leak adjacent memory contents into the error packet received by the Erlang process. However, this memory is owned by the same OS user, so the exposure scope is minimal from a cross-privilege perspective.

Integrity impact: None (CVSS I:N). The overflow cannot be weaponized for arbitrary write with attacker-controlled data beyond fixed tag interleaving; no code execution or data corruption is achievable.

Blast radius: All Erlang OTP releases from 17.0 (2014) through 27.3.4.12, 28.5.0.1, and 29.0.1. This spans roughly a decade of production deployments, including legacy telecom infrastructure and modern distributed systems. The affected component (inet_drv) is compiled into the emulator, so no language-level fix can mitigate it.

Detection Guidance

Sigma Rule

title: SCTP ERROR Chunk Flood - Erlang BEAM Crash Attempt
id: 6f3a1c2e-8b4d-4e5f-9a6b-2c1d3e4f5a6b
status: experimental
description: Detects potential exploitation of CVE-2026-49759 via anomalous SCTP ERROR chunk volumes or oversized cause parameter counts
author: valtersit.com Threat Intel
logsource:
    category: network_connection
    product: linux
detection:
    selection_sctp_error:
        network.transport: "sctp"
        sctp.chunk_type: "ERROR"
    selection_high_cause_count:
        sctp.cause_parameter_count: ">= 50"
    selection_oversize_packet:
        network.bytes: ">= 65535"
    condition: selection_sctp_error and (selection_high_cause_count or selection_oversize_packet)
level: high
falsepositives:
    - Legitimate SCTP diagnostic tools sending error reports
    - Malformed third-party SCTP implementations

YARA Rule

rule CVE_2026_49759_SCTP_Error_Chunk_Overflow
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects SCTP ERROR chunk packets with excessive cause code entries targeting Erlang inet_drv"
        cve = "CVE-2026-49759"
        date = "2025-01-15"
    strings:
        $sctp_error = { 09 [0-1] }  // SCTP chunk type 0x09 (ERROR) with valid flags
        $cause_code_1 = { 00 05 }    // Cause code 5 - Unrecognized Chunk Type
        $cause_code_2 = { 00 06 }    // Cause code 6 - Unrecognized Parameter
        $cause_code_3 = { 00 07 }    // Cause code 7 - Mandatory Parameter Missing
        $cause_code_4 = { 00 08 }    // Cause code 8 - Stale Cookie Error
    condition:
        uint8(0) == 0x09 and
        #cause_code_1 >= 10 and   // Hit the same cause code pattern repeatedly
        filesize >= 512           // Large ERROR chunk unlikely in normal ops
}

Suricata IDS Rule

alert sctp any any -> any any (msg:"ET EXPLOIT Erlang inet_drv SCTP ERROR chunk stack overflow attempt (CVE-2026-49759)"; sctp_chunk_type:9; content:"|00 05 00 04|"; threshold:type both, track by_dst, count 50, seconds 1; metadata:created_at 2025_01_15, updated_at 2025_01_15, cve CVE-2026-49759, signature_severity Major; reference:url,valtersit.com/cve-2026-49759; classtype:attempted-dos; sid:2026015; rev:1;)

Elastic Detection

sequence by destination.ip
  [ network where network.transport == "sctp" and sctp.chunk_type == "ERROR" ]
  [ network where network.transport == "sctp" and (
      sctp.cause_parameter_count >= 50 or network.bytes >= 65535
    )
  ]
  [ process where event.action == "end" and process.name == "beam.smp" and
      process.exit_code in (139, 134)  // SIGSEGV, SIGABRT
  ]

Splunk SPL Query

index=netflow OR index=packetbeat
  | where transport="sctp" AND chunk_type="ERROR"
  | eval cause_count=len(cause_parameters)
  | stats count by src_ip, dest_ip, dest_port, cause_count
  | where count >= 5 and cause_count >= 50
  | table _time, src_ip, dest_ip, dest_port, cause_count, count
  | sort - _time

Wazuh OSSEC Rule

<group name="erlang_sctp,">
    <rule id="100215" level="12">
        <if_sid>5715</if_sid> <!-- parent rule for unexpected process termination -->
        <field name="file">beam.smp</field>
        <description>CVE-2026-49759: Erlang BEAM crashed (SIGSEGV/SIGABRT) after potential SCTP ERROR chunk overflow</description>
        <group>exploit_attempt,</group>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The only patch source is OSV; Erlang/OTP has not yet published an official advisory. Validate the patch before deploying to production.

1. Immediate mitigations:

• Disable SCTP support in the Erlang distribution: remove -proto_dist inet_sctp from vm.args and ensure no application opens SCTP sockets ({sctp, true}). Restart all nodes.
• Block inbound and outbound SCTP traffic at network firewalls: iptables -A INPUT -p sctp --dport 0:65535 -m state --state NEW -j DROP (or equivalent on the external perimeter).
• If SCTP is essential for clustering, restrict SCTP access to trusted IP ranges using firewall allowlists.

2. Patch/upgrade steps:

• Upgrade Erlang/OTP to one of:
  • 27.3.4.13 (erts 15.2.7.9) or later in the 27.x branch
  • 28.5.0.2 (erts 16.4.0.2) or later
  • 29.0.2 (erts 17.0.2) or later
• On Debian/Ubuntu: apt-get update && apt-get install erlang=1:27.3.4.13-1 (verify actual package version).
• From source: git checkout OTP-27.3.4.13 && ./configure && make && sudo make install.
• Verify the fix by inspecting the spec[] array size in inet_drv.c and confirming the loop now performs if (spec_len >= MAX_CAUSES) break;.
• After upgrade, re-run your SCTP integration tests to confirm no regression.

3. Long-term hardening:

• Run Erlang nodes under systemd with Restart=on-failure and resource limits (LimitSTACK=8M) to minimize crash blast radius.
• Deploy an intrusion detection signature (Suricata/Zeek) to flag anomalous SCTP ERROR chunk volumes, as provided above.
• Monitor BEAM process crash events and correlate with SCTP connection logs.
• Reevaluate whether SCTP is genuinely required; TCP distribution with TLS provides comparable security with a smaller attack surface.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-49759
2. OSV Advisory (patch claim): https://osv.dev/vulnerability/CVE-2026-49759
3. Erlang/OTP Security Advisories: https://erlang.org/security
4. SCTP RFC 9260 (ERROR chunk format): https://www.rfc-editor.org/rfc/rfc9260.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / in-the-wild exploitation: As of this report, there is no evidence of active exploitation in the wild. The EPSS score of 0.00497 (39.9th percentile) indicates a low immediate exploitation likelihood. No CISA KEV listing exists. No known threat actor groups have published research on this vulnerability. The public PoC status refers to a proof-of-concept description (bug reproduction), not weaponized exploit code.