{
  "fix": "erlang-ic-java 1:20.2.2\u002Bdfsg-1ubuntu2\u002Besm4",
  "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-erlang-ic-java-1-20.2.2-dfsg-1ubuntu2-esm4",
  "summary": "erlang-ic-java 1:20.2.2\u002Bdfsg-1ubuntu2\u002Besm4, released October 9, 2026, fixes 23 CVEs in erlang-ic-java. None of them is reported as exploited. Patch Radar priority: High. The product is no longer supported.",
  "platform": "linux",
  "type": "package",
  "title": "erlang-ic-java 1:20.2.2\u002Bdfsg-1ubuntu2\u002Besm4 for Ubuntu 18.04.6 LTS (bionic)",
  "released": "2026-10-09T22:35:50Z",
  "priority": "High",
  "priorityTier": 3,
  "priorityReason": "Closes CVE-2026-28808, high severity",
  "supported": false,
  "cveCount": 23,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.00725,
  "maxCvss": 9.8,
  "appliesTo": [
    {
      "product": "erlang-ic-java",
      "productUrl": "https://patchblox.com/security/product/linux/erlang-ic-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:20.2.2\u002Bdfsg-1ubuntu2\u002Besm4",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-28808",
      "url": "https://patchblox.com/security/cve/CVE-2026-28808",
      "title": "ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)",
      "priority": "High",
      "severity": "Important",
      "cvss": 9.8,
      "epss": 0.00566,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-49759",
      "url": "https://patchblox.com/security/cve/CVE-2026-49759",
      "title": "Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash",
      "priority": "High",
      "severity": "Important",
      "cvss": 8.2,
      "epss": 0.00497,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-30211",
      "url": "https://patchblox.com/security/cve/CVE-2025-30211",
      "title": "erlang26: Fixed KEX init error results with excessive memory usage (bsc#1240390)",
      "priority": "High",
      "severity": "Medium",
      "cvss": 7.5,
      "epss": 0.00472,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-68956",
      "url": "https://patchblox.com/security/cve/CVE-2026-68956",
      "title": "SSH daemon allocates unbounded idle session channels, bypassing max_channels",
      "priority": "High",
      "severity": "Important",
      "epss": 0.00378,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-42790",
      "url": "https://patchblox.com/security/cve/CVE-2026-42790",
      "title": "nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification",
      "priority": "High",
      "severity": "Important",
      "cvss": 8.1,
      "epss": 0.00345,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-65634",
      "url": "https://patchblox.com/security/cve/CVE-2026-65634",
      "title": "Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder",
      "priority": "High",
      "severity": "Important",
      "epss": 0.00266,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23943",
      "url": "https://patchblox.com/security/cve/CVE-2026-23943",
      "title": "Pre-auth SSH DoS via unbounded zlib inflate",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 5.3,
      "epss": 0.00725,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-74994",
      "url": "https://patchblox.com/security/cve/CVE-2026-74994",
      "title": "inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth",
      "priority": "Routine",
      "severity": "Moderate",
      "epss": 0.00633,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-21620",
      "url": "https://patchblox.com/security/cve/CVE-2026-21620",
      "title": "erlang: Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file...",
      "priority": "Routine",
      "severity": "Low",
      "epss": 0.00519,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-26618",
      "url": "https://patchblox.com/security/cve/CVE-2025-26618",
      "title": "erlang: Fixed SSH SFTP packet size not verified properly in Erlang OTP (bsc#1237467).",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00498,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-23942",
      "url": "https://patchblox.com/security/cve/CVE-2026-23942",
      "title": "SFTP root escape via component-agnostic prefix check in ssh_sftpd",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 5.4,
      "epss": 0.00408,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-42789",
      "url": "https://patchblox.com/security/cve/CVE-2026-42789",
      "title": "Non-CA certificate accepted as intermediate issuer in public_key path validation",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 4.8,
      "epss": 0.00383,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-32147",
      "url": "https://patchblox.com/security/cve/CVE-2026-32147",
      "title": "SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 4.3,
      "epss": 0.00354,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-48856",
      "url": "https://patchblox.com/security/cve/CVE-2026-48856",
      "title": "httpc leaks Authorization header to cross-origin redirect targets",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.5,
      "epss": 0.00335,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-54886",
      "url": "https://patchblox.com/security/cve/CVE-2026-54886",
      "title": "SSH SFTP server denial of service via extended channel data infinite loop",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 4.3,
      "epss": 0.00331,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-48855",
      "url": "https://patchblox.com/security/cve/CVE-2026-48855",
      "title": "SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured",
      "priority": "Routine",
      "severity": "Low",
      "cvss": 6.5,
      "epss": 0.00299,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4748",
      "url": "https://patchblox.com/security/cve/CVE-2025-4748",
      "title": "Absolute path traversal in zip:unzip/1,2",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00292,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-53422",
      "url": "https://patchblox.com/security/cve/CVE-2026-53422",
      "title": "erlang: Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user...",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 4.3,
      "epss": 0.00262,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-54887",
      "url": "https://patchblox.com/security/cve/CVE-2026-54887",
      "title": "erlang: Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computa...",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 4.8,
      "epss": 0.00243,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-48858",
      "url": "https://patchblox.com/security/cve/CVE-2026-48858",
      "title": "ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 6.5,
      "epss": 0.00234,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-47078",
      "url": "https://patchblox.com/security/cve/CVE-2026-47078",
      "title": "erlang-megaco: Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended ext...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00149,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-49760",
      "url": "https://patchblox.com/security/cve/CVE-2026-49760",
      "title": "Stack Buffer Overflow in ei_s_print_term at Very Large Integer",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 5.5,
      "epss": 0.00136,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-54891",
      "url": "https://patchblox.com/security/cve/CVE-2026-54891",
      "title": "erlang: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP...",
      "priority": "Routine",
      "severity": "low",
      "cvss": 3.7,
      "epss": 0.00135,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-11T19:49:26Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}