Why SolarWinds Observability Self-Hosted is not affected by CVE-2026-55737, CVE-2026-55953, CVE-2026-58227, CVE-2026-59250, and CVE-2026-59251

In 2026, the National Institute of Standards and Technology (NIST) published a security bulletin about NVD - CVE-2026-55737 , NVD - CVE-2026-55953, NVD - CVE-2026-58227, NVD - CVE-2026-59250, and NVD - CVE-2026-59251.

CVE-2026-55737 is a signed-to-unsigned conversion and out-of-bounds write vulnerability in Erlang/OTP erts when processing Erlang External Term Format (ETF) data through binary_to_term/1. The issue occurs when a specially crafted LARGE_TUPLE_EXT value uses an arity that is interpreted differently during validation and decoding, causing the BEAM heap pointer to move backwards and resulting in an out-of-bounds heap write. Successful exploitation can crash the BEAM virtual machine and cause a denial of service.

CVE-2026-55953 is a TLS authentication vulnerability in the Erlang/OTP ssl application affecting TLS 1.2 and earlier and DTLS clients. The issue occurs because the client does not verify that the cipher suite selected by the server was among the suites originally offered by the client. An on-path attacker can exploit this by selecting an anonymous cipher suite that does not require a server certificate, bypassing certificate and hostname verification. Successful exploitation can allow the attacker to intercept and modify subsequent application traffic, compromising confidentiality and integrity. TLS 1.3 clients are not affected.

CVE-2026-58227 is an uncontrolled recursion vulnerability in the Erlang/OTP ssl application when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. The issue occurs when an attacker supplies mutually cross-signed certificates that create a cycle in the issuer relationships, causing certificate-chain reconstruction to recurse indefinitely without a depth limit. Successful exploitation can exhaust available memory and crash the BEAM virtual machine, resulting in a denial of service. The attack requires only a network connection and a partial TLS or DTLS handshake and does not require authentication.

CVE-2026-59250 is a buffer overflow and out-of-bounds write vulnerability in the Erlang/OTP Megaco text codec when the Flex scanner is enabled. The issue is exploitable when an attacker sends a specially crafted H.248/Megaco message containing a property parameter name longer than 452 bytes. Successful exploitation can cause the BEAM process to terminate and result in a denial of service. On OTP versions without compiler hardening protections, the memory corruption may potentially allow code execution. Exploitation requires the Megaco application to use the Flex scanner and its transport port to be reachable by the attacker.

CVE-2026-59251 is an uncontrolled resource consumption vulnerability in the Erlang/OTP public_key application during X.509 certificate path validation. The issue occurs during RFC 5280 certificate policy processing, where the certificate policy tree can grow exponentially based on the number of policies and certificates in the chain. An attacker can exploit the issue by presenting a specially crafted X.509 certificate chain during a TLS handshake. Successful exploitation can exhaust the BEAM node's memory and pin its schedulers, causing the entire virtual machine to become unavailable.

Although SolarWinds Observability Self-Hosted includes a version of Erlang/OTP affected by these vulnerabilities, the product is not impacted because it does not use the vulnerable functions.