# erlang-ic-java 1:20.2.2+dfsg-1ubuntu2+esm3: erlang-ic-java 1:20.2.2+dfsg-1ubuntu2+esm3 for Ubuntu 18.04.6 LTS (bionic)

erlang-ic-java 1:20.2.2+dfsg-1ubuntu2+esm3, released September 29, 2026, fixes 16 CVEs in erlang-ic-java. None of them is reported as exploited. Patch Radar priority: High. The product is no longer supported.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-bionic-erlang-ic-java-1-20.2.2-dfsg-1ubuntu2-esm3
- Platform: Linux
- Released: Sep 29, 2026
- Priority: High (Closes CVE-2026-66835, high severity)
- CVEs: 16, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [erlang-ic-java](https://patchblox.com/security/data/product/linux/erlang-ic-java.md) | Ubuntu 18.04.6 LTS (bionic) | 1:20.2.2+dfsg-1ubuntu2+esm3 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-66835](https://patchblox.com/security/data/cve/CVE-2026-66835.md) | High | httpd mod_auth directory protection bypassed by a doubled slash in the request path | n/a | 0.0097 |  |
| [CVE-2026-69664](https://patchblox.com/security/data/cve/CVE-2026-69664.md) | High | httpd parks a request worker indefinitely on a malformed chunk size sent after the headers | n/a | 0.0095 |  |
| [CVE-2026-73270](https://patchblox.com/security/data/cve/CVE-2026-73270.md) | High | httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems | n/a | 0.0093 |  |
| [CVE-2026-75538](https://patchblox.com/security/data/cve/CVE-2026-75538.md) | High | A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer | n/a | 0.0085 |  |
| [CVE-2026-55951](https://patchblox.com/security/data/cve/CVE-2026-55951.md) | High | httpc memory exhaustion via unbounded response header accumulation | n/a | 0.0069 |  |
| [CVE-2026-71380](https://patchblox.com/security/data/cve/CVE-2026-71380.md) | High | httpd applies no timeout while receiving a request body, parking a worker on a stalled client | n/a | 0.0067 |  |
| [CVE-2026-66357](https://patchblox.com/security/data/cve/CVE-2026-66357.md) | High | inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation | n/a | 0.0058 |  |
| [CVE-2026-74835](https://patchblox.com/security/data/cve/CVE-2026-74835.md) | High | inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception | n/a | 0.0058 |  |
| [CVE-2026-73812](https://patchblox.com/security/data/cve/CVE-2026-73812.md) | High | inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length | n/a | 0.0052 |  |
| [CVE-2026-23941](https://patchblox.com/security/data/cve/CVE-2026-23941.md) | High | Request smuggling via first-wins Content-Length parsing in inets httpd | 9.4 | 0.0051 |  |
| [CVE-2026-42792](https://patchblox.com/security/data/cve/CVE-2026-42792.md) | High | erlang: Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote... | 7.5 | 0.0044 |  |
| [CVE-2026-55953](https://patchblox.com/security/data/cve/CVE-2026-55953.md) | High | erlang: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server authentication | 7.4 | 0.0023 |  |
| [CVE-2026-70399](https://patchblox.com/security/data/cve/CVE-2026-70399.md) | Routine | erlang: Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticate... | n/a | 0.0093 |  |
| [CVE-2026-59250](https://patchblox.com/security/data/cve/CVE-2026-59250.md) | Routine | erlang: Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to co... | n/a | 0.0078 |  |
| [CVE-2026-70405](https://patchblox.com/security/data/cve/CVE-2026-70405.md) | Routine | erlang: Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degra... | n/a | 0.0071 |  |
| [CVE-2026-70409](https://patchblox.com/security/data/cve/CVE-2026-70409.md) | Routine | eldap does not bound the port component of a referral URL before integer conversion | n/a | 0.0058 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.