# SUSE-SU-2026:3579-1: erlang26 security update SUSE-SU-2026:3579-1, released August 11, 2026, fixes 22 CVEs in erlang26 (version 26.2.1-150300.7.28.1). None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/suse-su-2026-3579-1 - Platform: Linux - Released: Aug 11, 2026 - Priority: High (Closes CVE-2026-49759, high severity) - CVEs: 22, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:3579-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [erlang26](https://patchblox.com/security/data/product/linux/erlang26.md) | sles 15.6 | 26.2.1-150300.7.28.1 | | [erlang26](https://patchblox.com/security/data/product/linux/erlang26.md) | sles 15.7 | 26.2.1-150300.7.28.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-49759](https://patchblox.com/security/data/cve/CVE-2026-49759.md) | High | Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash | 8.2 | 0.0050 | | | [CVE-2026-55952](https://patchblox.com/security/data/cve/CVE-2026-55952.md) | High | erlang: The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 Clie... | 7.5 | 0.0048 | | | [CVE-2026-42792](https://patchblox.com/security/data/cve/CVE-2026-42792.md) | High | erlang: Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote... | 7.5 | 0.0044 | | | [CVE-2026-58227](https://patchblox.com/security/data/cve/CVE-2026-58227.md) | High | erlang: The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during... | 7.5 | 0.0039 | | | [CVE-2026-42790](https://patchblox.com/security/data/cve/CVE-2026-42790.md) | High | nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification | 8.1 | 0.0035 | | | [CVE-2026-59251](https://patchblox.com/security/data/cve/CVE-2026-59251.md) | High | erlang: Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthent... | 7.5 | 0.0032 | | | [CVE-2026-55737](https://patchblox.com/security/data/cve/CVE-2026-55737.md) | High | erlang: Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who c... | 7.5 | 0.0029 | | | [CVE-2026-55953](https://patchblox.com/security/data/cve/CVE-2026-55953.md) | High | erlang: The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server... | 7.4 | 0.0023 | | | [CVE-2026-59250](https://patchblox.com/security/data/cve/CVE-2026-59250.md) | Routine | erlang: Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to co... | n/a | 0.0078 | | | [CVE-2026-42789](https://patchblox.com/security/data/cve/CVE-2026-42789.md) | Routine | Non-CA certificate accepted as intermediate issuer in public_key path validation | 4.8 | 0.0038 | | | [CVE-2026-55950](https://patchblox.com/security/data/cve/CVE-2026-55950.md) | Routine | erlang: Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows a... | 5.9 | 0.0038 | | | [CVE-2026-48856](https://patchblox.com/security/data/cve/CVE-2026-48856.md) | Routine | httpc leaks Authorization header to cross-origin redirect targets | 6.5 | 0.0034 | | | [CVE-2026-54886](https://patchblox.com/security/data/cve/CVE-2026-54886.md) | Routine | SSH SFTP server denial of service via extended channel data infinite loop | 4.3 | 0.0033 | | | [CVE-2026-48855](https://patchblox.com/security/data/cve/CVE-2026-48855.md) | Routine | SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured | 6.5 | 0.0030 | | | [CVE-2026-28810](https://patchblox.com/security/data/cve/CVE-2026-28810.md) | Routine | Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver | 3.7 | 0.0027 | | | [CVE-2026-53422](https://patchblox.com/security/data/cve/CVE-2026-53422.md) | Routine | erlang: Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user... | 4.3 | 0.0026 | | | [CVE-2026-54887](https://patchblox.com/security/data/cve/CVE-2026-54887.md) | Routine | erlang: Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computa... | 4.8 | 0.0024 | | | [CVE-2026-48858](https://patchblox.com/security/data/cve/CVE-2026-48858.md) | Routine | ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks | 6.5 | 0.0023 | | | [CVE-2026-48860](https://patchblox.com/security/data/cve/CVE-2026-48860.md) | Routine | Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist | 6.5 | 0.0021 | | | [CVE-2026-47078](https://patchblox.com/security/data/cve/CVE-2026-47078.md) | Routine | erlang-megaco: Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended ext... | n/a | 0.0015 | | | [CVE-2026-49760](https://patchblox.com/security/data/cve/CVE-2026-49760.md) | Routine | Stack Buffer Overflow in ei_s_print_term at Very Large Integer | 5.5 | 0.0014 | | | [CVE-2026-54891](https://patchblox.com/security/data/cve/CVE-2026-54891.md) | Routine | erlang: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP... | 3.7 | 0.0014 | | --- Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.