Erlang Otp CVE-2026-54890

We need to produce a JSON with the specified fields. The input includes CVE-2026-54890. The description: Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules). It leads to excessive allocation and VM abort. Affected OTP versions: OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11. CVSS 4.0: 8.2, vector given. CVSS 3.1? Not provided, we need to assess our own. CWE-191. Tags: Denial Of Service, Integer Overflow. SSVC: Exploitation none, Automatable no, Technical Impact partial. No mention of EPSS, no KEV (KEV status not provided, presumably not). References: CNA, GitHub commit, advisory, OSV, version order. There's a diff showing the fix. So we need to synthesize.

Now, let's craft each field.

Product name: Erlang/OTP (OTP is the full name, "Erlang/OTP" is common). So "Erlang/OTP". Simpler: "Erlang OTP". The primary product. So "Erlang/OTP". Could be "Erlang/OTP ERTS". But to keep concise: "Erlang/OTP". Since the vulnerability is in the erts module. The description says "erlang otp erlang/otp (erts modules)". So I'll go with "Erlang/OTP".

Summary: Start with impact verb and product. Remote Denial of Service? The crash is VM-level abort, causing node to abort by allocating huge memory. So "Denial of service in Erlang/OTP ERTS's ETF decoder allows remote attackers to crash the VM node." Affects versions. Not actively exploited (no KEV, SSVC exploitation: none, automatable: no, but note that crash is DoS). No mention of POC. So use: "no public exploit identified at time of analysis". The attack vector: sending a crafted ETF binary. The decoder has integer underflow. Impact: node abort, not catchable. So: "Denial of service in Erlang/OTP's External Term Format (ETF) decoder allows remote attackers to crash the Erlang VM by sending a specially crafted binary term with BIT_BINARY_EXT tag having zero length and trailing bits fields. The resul