SB2026101489 - Multiple vulnerabilities in Erlang OTP
Published: October 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Key Exchange without Entity Authentication (CVE-ID: CVE-2026-89422)
CWE-ID: CWE-322 - Key Exchange without Entity Authentication
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to impersonate TLS servers, disclose sensitive information, and forge application responses.
The vulnerability exists due to key exchange without server authentication in the Erlang/OTP ssl application's TLS 1.3 client when processing a ServerHello containing a pre_shared_key extension that the client never offered. A remote attacker can send this unsolicited extension and a Finished message computed using its own ephemeral ECDHE key to impersonate TLS servers, disclose sensitive information, and forge application responses.
Exploitation requires a malicious host that the client connects to or an on-path peer able to answer the connection. The issue occurs even with verify_peer and trusted CA certificates configured. No certificate, private key, or prior session is needed. Clients restricted to TLS 1.2 are not affected.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-68956)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to resource allocation without limits in the Erlang/OTP SSH daemon's session channel handling when opening idle session channels that are not counted against max_channels. A remote user can open a large number of session channels without starting a shell, command, or subsystem to cause a denial of service.
A single SSH connection is sufficient for exploitation.
Remediation
Install update from vendor's website.