[AutoPR- Security] Patch erlang for CVE-2026-75538, CVE-2026-74994, CVE-2026-74835, CVE-2026-73812, CVE-2026-73276, CVE-2026-73270, CVE-2026-71380, CVE-2026-70399, CVE-2026-69664, CVE-2026-66357, CVE-2026-55951 [HIGH]

[Azure Linux Security Servicing Account (azurelinux-security)]

Auto Patch erlang for CVE-2026-75538, CVE-2026-74994, CVE-2026-74835, CVE-2026-73812, CVE-2026-73276, CVE-2026-73270, CVE-2026-71380, CVE-2026-70399, CVE-2026-69664, CVE-2026-66357, CVE-2026-55951.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1196859&view=results

CVE-2026-73812 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1196874&view=results
CVE-2026-71380 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1196872&view=results
CVE-2026-55951 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1196873&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

• Auto Patch erlang for CVE-2026-75538 (HIGH), CVE-2026-74994 (MEDIUM), CVE-2026-74835 (HIGH), CVE-2026-73812 (HIGH), CVE-2026-73276 (HIGH), CVE-2026-73270 (HIGH), CVE-2026-71380 (HIGH), CVE-2026-70399 (HIGH), CVE-2026-69664 (HIGH), CVE-2026-66357 (HIGH), CVE-2026-55951 (HIGH).

Change Log

• CVE-2026-75538
• CVE-2026-74994
• CVE-2026-74835
• CVE-2026-73812
• CVE-2026-73276
• CVE-2026-73270
• CVE-2026-71380
• CVE-2026-70399
• CVE-2026-69664
• CVE-2026-66357
• CVE-2026-55951

Does this affect the toolchain?

YES/NO

Associated issues

• N/A

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-75538
• https://nvd.nist.gov/vuln/detail/CVE-2026-74994
• https://nvd.nist.gov/vuln/detail/CVE-2026-74835
• https://nvd.nist.gov/vuln/detail/CVE-2026-73812
• https://nvd.nist.gov/vuln/detail/CVE-2026-73276
• https://nvd.nist.gov/vuln/detail/CVE-2026-73270
• https://nvd.nist.gov/vuln/detail/CVE-2026-71380
• https://nvd.nist.gov/vuln/detail/CVE-2026-70399
• https://nvd.nist.gov/vuln/detail/CVE-2026-69664
• https://nvd.nist.gov/vuln/detail/CVE-2026-66357
• https://nvd.nist.gov/vuln/detail/CVE-2026-55951

Test Methodology

• Pipeline build id: Buddy Build URL

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[kgodara912]

Updated buddy build.

[kgodara912]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.

[Aditya Singh (v-aaditya)]

Peer-review:

CVE-2026-75538

• The patch completely matches with upstream patch.

CVE-2026-74994

• The patch completely matches with upstream patch.

CVE-2026-74835

• The patch completely matches with upstream patch.

CVE-2026-73812

• The patch has been modified to drop changes in file httpd_request_handler.erl which are already present.

CVE-2026-73276

• The patch completely matches with upstream patch except the changes in file lib/inets/src/http_server/httpd_request_handler.erl as they are already present.

CVE-2026-73270

• The patch completely matches with upstream patch except the changes in test file lib/inets/test/httpd_SUITE.erl are not included.
• This CVE also fixes - CVE-2026-66835

CVE-2026-71380

• The patch completely matches with upstream patch.

CVE-2026-70399

• The patch completely matches with upstream patch except the changes in test files lib/inets/test/httpd_SUITE.erl and lib/inets/test/httpd_basic_SUITE.erl are not included.

CVE-2026-69664

• The patch completely matches with upstream patch.

CVE-2026-66357

• The patch completely matches with upstream patch.

CVE-2026-55951

• The patch completely matches with upstream patch except some comments from upstream patch in file lib/inets/src/http_client/httpc.erl and some sections from test file lib/inets/test/httpc_SUITE.erl are not included.
• This CVE also fixes - CVE-2026-59696, CVE-2026-70405, CVE-2026-70409, CVE-2026-71562

1. All the patches apply cleanly. (Checked .rpm.log)
2. Ptest has passed. (Checked .rpm.test.log)
3. All patches have respective upstream patch reference.
4. PR has security tag.
5. Buddy Build is successful.

Kindly Note - I found 1 issue which is related to test case in CVE-2026-73812.patch. The test case te_cl_smuggling_reject is not registered in the http_1_1 group in httpd_SUITE.erl file. Without it the test function is dead code.

Rest is LGTM.