erlang-mode builds the manpage menus by searching for manpages in the directory specified
using the erlang-root-dir variable setted to "/usr/lib/erlang" in
/etc/emacs/site-start.d/50erlang-mode.el, and the erlang-man-dirs variable setted on
erlang-mode.el. Then uses a regex defined in erlang-mode.el as:

  (defun erlang-man-get-files (dir)
    "Return files in directory DIR."
    (directory-files dir t ".*\\.\\([124-9]\\|3erl\\)?\\(\\.gz\\)?\\'"))

The erlang-manpages package installs the manpages on /usr/share/man/* where non erlang
related manpages also reside, and creates a /usr/lib/erlang/man -> /usr/share/man symlink.

So, by traversing that symlink erlang-mode erroneously founds all manpages in the system as
erlang ones.

Two notes about the regex: 1- there are other similar regexes used in
erlang-mode.el 2- the "3erl" string must be optional because there are manpages like
/usr/share/man/man6/kernel.6.gz that not contain it.

I think the proper solution is to modify erlang-manpages to create an
/usr/lib/erlang/man directory instead of a symlink, and then man{3,4,6} directories
containing  one symlink for each manpage to his corresponding file in /usr/share/man
(or viceversa).

Btw, this seems to be the continuation of the #436044 bug :) Creating the /usr/lib/erlang/man
was a bad solution, erlang manpages become undifferentiated, but the empty /usr/lib/erlang/man
was also bad.

severity 558199 minor
tags 558199 + wontfix
thanks

3erl here means that only manpages in 3erl subsection will be
searched. Which makes the most important section correct. Emacs shows
only Erlang-related manpages for section 3.

It's a policy rule to put manpages under /usr/share/man (it's
convenient to use 'man' for all manpages and don't try to remember
when you should type 'man' and when 'erl -man' whatever.

Which isn't too problematic as there are not too many manpages in
sections 4 and 6. Only section 1 contains many manuals.

The regexp is correct.

It seems to be too complicated for me. While I agree that the change
introduced in the Debian package creates some inconvenience for Emacs
user I think that it isn't too annoying to excuse symlinking.

Cheers!

I think you are wrong,"3erl" is optional as the "?" character
indicates, so Emacs will show all the manpages in the
/usr/share/man/man3 directory, not only the Erlang related ones. If
you make the "3erl" mandatory in that line by deleting the "?"
character, then some erlang manpages will not show, for example
/usr/share/man/man6/crypto.6.gz , so doing that isn't a solution.

I agree with that.

Maybe you have too few packages installed in your system, in mine the
Erlang man menu is cluttered with many non-erlang related manpages.
For example, I see manpages for awk, kolf, konquest, etc.

I didn't propose any regex changes in that paragraph, I was only
indicating that the "3erl" string is optional.

Another solution is to make a "\derl" regex mandatory in emacs-mode
and change the filenames like /usr/share/man/man6/stdlib.6.gz to
/usr/share/man/man6/stdlib.6erl.gz . But probably the most
non-intrusive solution is to create the symlinks from
/usr/lib/erlang/man to /usr/share/man.

We believe that the bug you reported is fixed in the latest version of
erlang, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 558199@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sergei Golovan <sgolovan@debian.org> (supplier of updated erlang package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 21 Aug 2026 17:34:23 +0300
Source: erlang
Architecture: source
Version: 1:29.0.6+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Erlang Packagers <pkg-erlang-devel@lists.alioth.debian.org>
Changed-By: Sergei Golovan <sgolovan@debian.org>
Closes: 558199 999682 1146603
Changes:
 erlang (1:29.0.6+dfsg-1) unstable; urgency=medium
 .
   * New upstream release.
     - Fix CVE-2026-55951: The Erlang/OTP httpc HTTP client does not enforce
       a limit on the total size of response headers received from a server.
     - Fix CVE-2026-59696: Improper Validation of Specified Quantity in Input
       vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade
       availability by supplying a URI whose port component is a very long run
       of digits.
     - Fix CVE-2026-66835: Path Equivalence vulnerability in Erlang/OTP inets
       httpd allows a remote unauthenticated attacker to read files inside
       a mod_auth protected directory by prefixing the request path with
       an extra slash.
     - Fix CVE-2026-69664: Missing Release of Resource after Effective Lifetime
       vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote
       attacker to cause denial of service by sending a request with a chunked
       body whose chunk-size line is not a hexadecimal number.
     - Fix CVE-2026-70399: Allocation of Resources Without Limits or Throttling
       vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote
       attacker to cause denial of service by opening and holding open a large
       number of connections.
     - Fix CVE-2026-70405: Improper Validation of Specified Quantity in Input
       vulnerability in Erlang/OTP snmp allows a remote attacker to degrade
       availability by sending an SNMP message containing a BER INTEGER whose
       length field is arbitrarily large.
     - Fix CVE-2026-70409: Improper Validation of Specified Quantity in Input
       vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP
       server to degrade availability by returning a referral URL whose port
       component is a very long run of digits.
     - Fix CVE-2026-71380: Missing Release of Resource after Effective Lifetime
       vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote
       attacker to cause denial of service by sending valid request headers
       with a large Content-Length and then stalling before the body
       is complete.
     - Fix CVE-2026-73270: Improper Handling of Case Sensitivity vulnerability
       in Erlang/OTP inets httpd allows a remote unauthenticated attacker
       to read files inside a mod_auth protected directory by requesting them
       with different casing, on deployments whose filesystem
       is case-insensitive.
     - Fix CVE-2026-73276: Gracefulness code ignored cases that should
       be rejected, resulting in possible HTTP Request Smuggling opportunities.
     - Fix CVE-2026-73812: httpd function check_header/3 rejects duplicate
       Content-Length (per CVE-2026-23941) but never checks for the TE+CL
       co-presence that RFC 9112 §6.3 identifies as a probable smuggling
       attempt.
     - Fix CVE-2026-74835: The inets application HTTP server httpd fails
       to enforce a configured body-size limit on chunked request.
     - Fix CVE-2026-74994: The mod_auth module in OTP's inets httpd server,
       when configured with dets or mnesia authentication backends and multiple
       directory configuration blocks, collapses all directory blocks into
       a single shared user/group namespace.
     - Fix CVE-2026-75538: An attacker that connects to an open Erlang TCP
       port that uses the inet driver with {packet,4} mode can use a signed
       overflow in an incorrect packet length calculation to overflow
       the receive buffer into the VM allocator area and beyond
       up to about 2 GB.
     Closes: #1146603.
   * Replace dependency of erlang-jinterface on java2-runtime(-headless)
     by dependency on java-runtime(-headless).
   * Add conflict of erlang-doc with erlang-mode version less than 27.0
     because the /usr/lib/erlang/man symlink was moved from the former package
     to the latter.
   * Erlang related manpages are now shipped in erlang-doc under the
     /usr/share/erlang-doc/man hierarchy, which avoids showing non-Erlang
     manpages in Emacs menu (closes: #558199, #999682).
   * Add gbp.conf with pristine-tar directive, which is needed to produce
     the original tarball with empty directories.
Checksums-Sha1:
 2e0b658dd1567fae70cdcb25fbc8234d510e3b00 5002 erlang_29.0.6+dfsg-1.dsc
 777f84b4e984655c5542f874f178d14b60050b7e 49301784 erlang_29.0.6+dfsg.orig.tar.xz
 6a035187b413e8748173c9a3e1d64176f8ac9d28 63716 erlang_29.0.6+dfsg-1.debian.tar.xz
 92bbc1e6cfd0562420b46e09de4db95ad4b6407c 32289 erlang_29.0.6+dfsg-1_amd64.buildinfo
Checksums-Sha256:
 dfe95edd32300f4127bd01d974625c41da29a3a48113dc5426b6fc56b40dd039 5002 erlang_29.0.6+dfsg-1.dsc
 e679fe8262e5ec32701857e7bc8034032090bf6e2ac0565301a7feca4fb0626f 49301784 erlang_29.0.6+dfsg.orig.tar.xz
 1cd7a021c8c48a878656b1239afa91c69dd4f1db53d9b97bf4d79f97aa807327 63716 erlang_29.0.6+dfsg-1.debian.tar.xz
 fdc2036ddf41b2b560eef31def1a7393e40888e80144ea3fb88b7a6dc421e4a0 32289 erlang_29.0.6+dfsg-1_amd64.buildinfo
Files:
 766ccde1098c2a268f989a3dfaffef95 5002 interpreters optional erlang_29.0.6+dfsg-1.dsc
 6d4a3f0c1c4340634ffd7a3daac8f135 49301784 interpreters optional erlang_29.0.6+dfsg.orig.tar.xz
 5fbedfa8e66cb2a89af6ecb8668647a8 63716 interpreters optional erlang_29.0.6+dfsg-1.debian.tar.xz
 76d16823ead2c706c6940be087943454 32289 interpreters optional erlang_29.0.6+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE/SYPsyDB+ShSnvc4Tyrk60tj54cFAmqcXkYACgkQTyrk60tj
54dizg//fD1Hi3jOwrRzRSASoruqGbqaF4+OrvBoy9oJPV8jXqUR0quEndxenixB
H+G8FrY9SChseWP4q5/Mzkh2i5HWvYLNLBdWcmiY4yLunvRMyJ6yly+mwYR8PQB/
qJ7xXtuemVBvMAa7gCmMjeBm5K2a/8UdwWTViVXlVFvssQib3xKNd6ndNtiu4hWD
lD0cjCagPrAbK4AASLvYFmn2A9FHRPndPv5VK8JHxM0aFJlwSoyye2ds8SyPxF6A
LphdPjOP07t8xGkAmhZVrVEsgcAqYKGYC8XzLX3wdijWkpTVyC8mQqUricRzGs3I
ooO2cqqCecpQcT6h2gWHaess74Psnu7cw4dihiN4AAK4fbSCZxnPZce2BTDpwbOi
P7qpO8fJnHJVCxAzFrYN+JsWLWnW9M9DlgHAPRT3rKmoqspL2kZdyQMtibaW/CDp
u8doP4EufhGVHY3NWc5wv0S7tg0QopuMSfpesFyYCXTeUYJU9fXnG/zJ2ZsHEm/S
lmK0LYKLqa8gRR/U4+W2gffHLqaCT3egNUPR5b9H5Lu55xa/XiVmcFlYizQSD1pd
5hDBOx0BwMrxTiRaa11NyFqlHqFYSA09k39fhCb7wuuBHrQx6kR5HZocLjFso+ri
Mienoi/r0R5FK7qShr0/OJ0qWbfe1NfVPRKDpt1cwJ3q5F1KQbg=
=rEkC
-----END PGP SIGNATURE-----