[Medium] Patch erlang for CVE-2026-53422, CVE-2026-54887, CVE-2026-55950, CVE-2026-59250

[Aditya Singh (v-aaditya)]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Patch erlang for CVE-2026-53422, CVE-2026-54887, CVE-2026-55950, CVE-2026-59250

Change Log

• new file: SPECS/erlang/CVE-2026-53422.patch
• new file: SPECS/erlang/CVE-2026-54887.patch
• new file: SPECS/erlang/CVE-2026-55950.patch
• new file: SPECS/erlang/CVE-2026-59250.patch
• modified: SPECS/erlang/erlang.spec

Does this affect the toolchain?

NO

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-53422
• https://nvd.nist.gov/vuln/detail/CVE-2026-54887
• https://nvd.nist.gov/vuln/detail/CVE-2026-55950
• https://nvd.nist.gov/vuln/detail/CVE-2026-59250

Test Methodology

• Local build was successful.

• Patches apply cleanly.
  

• License check script shows no warning.

• Installation and Uninstallation on docker image was successful.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Singh (v-aaditya)]

CVE-2026-53422 -

1. The CVE affects current erlang version 26.2.5.21 which is in affected range of < 27.3.4.14.
2. The affected file lib/ssh/src/ssh_sftpd.erl & lib/ssh/test/ssh_sftpd_SUITE.erl and affected function handle_op are present.
3. Patch backported - YES.
4. Patch matches with upstream although the utility functions CT_LOG and CT_FAIL has been added in lib/ssh/test/ssh_test_lib.hrl file similar to upstream as they were not present in current source code and are being used in the upstream patch.
5. Patch has upstream patch reference.
6. Patch applies cleanly.

CVE-2026-54887 -

1. The CVE affects current erlang version 26.2.5.21 which is in affected range of < 27.3.4.14.
2. Although the affected file in upstream is lib/ssl/src/dtls_connection.erl while on AZL it is lib/ssl/src/dtls_connection.erl and affected function handle_op is same as upstream and affected code are present.
3. Patch backported - YES.
4. Patch matches with upstream.
5. Patch has upstream patch reference.
6. Patch applies cleanly.

CVE-2026-55950 -

1. The CVE affects current erlang version 26.2.5.21 which is in affected range of < 27.3.4.14.
2. The affected file lib/ssl/src/dtls_packet_demux.erl, affected function handle_call and affected code are present.
3. Patch backported - NO.
4. Patch matches with upstream.
5. Patch has upstream patch reference.
6. Patch applies cleanly.

CVE-2026-59250 -

1. The CVE affects current erlang version 26.2.5.21 which is in affected range of < 27.3.4.14.
2. The affected file lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src, affected functions mfs_alloc_failed & mfs_load_property_groups and affected code are present.
3. Patch backported - NO.
4. Patch matches with upstream.
5. Patch has upstream patch reference.
6. Patch applies cleanly.

• The ptest has passed.
• Buddy Build has been triggered and it has passed.
• Peer-review is completed by Akhila Guruju (@akhila-guruju)

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Singh (v-aaditya)]

Resolved merge conflict.