A critical memory management vulnerability in Erlang OTP allows unauthenticated attackers to trigger integer underflow conditions, potentially leading to excessive memory allocation and system instability.

This vulnerability involves CWE-191 (Integer Underflow), CWE-789 (Memory Allocation with Excessive Size Value), and CWE-1284 (Improper Validation of Specified Quantity). These flaws allow unauthenticated remote attackers to provide input that causes the system to allocate excessive memory, leading to potential service failure.

The ability to force excessive memory allocation poses a severe threat to system availability, as attackers can crash critical services running on the Erlang runtime. With a CVSS score of 8.2, this vulnerability is a high-priority risk for environments relying on Erlang for high-concurrency applications.

Immediate Action: Consult the vendor advisory and check for available updates for the Erlang/OTP runtime environment, as patches may vary based on the specific distribution.

Proactive Monitoring: Monitor memory usage across all nodes running Erlang/OTP and implement alerts for sudden, large allocation requests that exceed standard operational thresholds.

Compensating Controls: Restrict network access to services running on Erlang/OTP to trusted sources only, limiting the exposure of vulnerable entry points to potential attackers.

Public Exploit Available: No

Organizations should immediately review their Erlang/OTP implementations and identify systems running versions within the affected range. Because this affects the core runtime (erts), applying updates is critical to ensuring the underlying stability of all dependent applications.