erlang (1:29.0.6+dfsg-1) [PTS] [DDPO]

OK: VCS matches the version in the archive

Git: https://salsa.debian.org/erlang-team/packages/erlang.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: master
Path: debian/changelog
Repo size: 8163328
Browser: https://salsa.debian.org/erlang-team/packages/erlang
Last scan: 2026-09-05 21:16:29+00
Error: https://salsa.debian.org/api/v4/projects/erlang-team%2Fpackages%2Ferlang API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.
Next scan: 2026-09-12 20:32:00+00

Debian changelog in Git:

erlang (1:29.0.6+dfsg-1) unstable; urgency=medium

  * New upstream release.
    - Fix CVE-2026-55951: The Erlang/OTP httpc HTTP client does not enforce
      a limit on the total size of response headers received from a server.
    - Fix CVE-2026-59696: Improper Validation of Specified Quantity in Input
      vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade
      availability by supplying a URI whose port component is a very long run
      of digits.
    - Fix CVE-2026-66835: Path Equivalence vulnerability in Erlang/OTP inets
      httpd allows a remote unauthenticated attacker to read files inside
      a mod_auth protected directory by prefixing the request path with
      an extra slash.
    - Fix CVE-2026-69664: Missing Release of Resource after Effective Lifetime
      vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote
      attacker to cause denial of service by sending a request with a chunked
      body whose chunk-size line is not a hexadecimal number.
    - Fix CVE-2026-70399: Allocation of Resources Without Limits or Throttling
      vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote
      attacker to cause denial of service by opening and holding open a large
      number of connections.
    - Fix CVE-2026-70405: Improper Validation of Specified Quantity in Input
      vulnerability in Erlang/OTP snmp allows a remote attacker to degrade
      availability by sending an SNMP message containing a BER INTEGER whose
      length field is arbitrarily large.
    - Fix CVE-2026-70409: Improper Validation of Specified Quantity in Input
      vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP
      server to degrade availability by returning a referral URL whose port
      component is a very long run of digits.
    - Fix CVE-2026-71380: Missing Release of Resource after Effective Lifetime
      vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote
      attacker to cause denial of service by sending valid request headers
      with a large Content-Length and then stalling before the body
      is complete.
    - Fix CVE-2026-73270: Improper Handling of Case Sensitivity vulnerability
      in Erlang/OTP inets httpd allows a remote unauthenticated attacker
      to read files inside a mod_auth protected directory by requesting them
      with different casing, on deployments whose filesystem
      is case-insensitive.
    - Fix CVE-2026-73276: Gracefulness code ignored cases that should
      be rejected, resulting in possible HTTP Request Smuggling opportunities.
    - Fix CVE-2026-73812: httpd function check_header/3 rejects duplicate
      Content-Length (per CVE-2026-23941) but never checks for the TE+CL
      co-presence that RFC 9112 §6.3 identifies as a probable smuggling
      attempt.
    - Fix CVE-2026-74835: The inets application HTTP server httpd fails
      to enforce a configured body-size limit on chunked request.
    - Fix CVE-2026-74994: The mod_auth module in OTP's inets httpd server,
      when configured with dets or mnesia authentication backends and multiple
      directory configuration blocks, collapses all directory blocks into
      a single shared user/group namespace.
    - Fix CVE-2026-75538: An attacker that connects to an open Erlang TCP
      port that uses the inet driver with {packet,4} mode can use a signed
      overflow in an incorrect packet length calculation to overflow
      the receive buffer into the VM allocator area and beyond
      up to about 2 GB.
    Closes: #1146603.
  * Replace dependency of erlang-jinterface on java2-runtime(-headless)
    by dependency on java-runtime(-headless).
  * Add conflict of erlang-doc with erlang-mode version less than 27.0
    because the /usr/lib/erlang/man symlink was moved from the former package
    to the latter.
  * Erlang related manpages are now shipped in erlang-doc under the
    /usr/share/erlang-doc/man hierarchy, which avoids showing non-Erlang
    manpages in Emacs menu (closes: #558199, #999682).
  * Add gbp.conf with pristine-tar directive, which is needed to produce
    the original tarball with empty directories.

 -- Sergei Golovan <sgolovan@debian.org>  Fri, 21 Aug 2026 17:34:23 +0300

This branch is even with tag debian/1%29.0.6+dfsg-1