SB2026101490 - Multiple vulnerabilities in Erlang OTP
Published: October 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper Certificate Validation (CVE-ID: CVE-2026-105236)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass client certificate authentication for a protected SNI virtual host.
The vulnerability exists due to improper certificate validation in the Erlang/OTP ssl TLS 1.2 session resumption implementation when accepting session-ID resumptions across SNI virtual hosts. A remote attacker can resume a session established at a lower-trust SNI name at a higher-trust SNI name without the cached client certificate being validated against the higher-trust certificate authority to bypass client certificate authentication for a protected SNI virtual host.
Exploitation requires at least two SNI names on one listener sharing a server certificate but using distinct client certificate authorities, negotiated TLS 1.2, and enabled session reuse. A legitimate client certificate for the lower-trust SNI name is required, but no certificate trusted by the protected SNI name is needed. TLS 1.3 is not affected.
2) Infinite loop (CVE-ID: CVE-2026-96596)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an infinite loop with an unreachable exit condition in erl_tar:do_sparse_read/3 and its bundled copies when extracting GNU sparse members to disk. A remote attacker can supply a tar archive containing a crafted GNU sparse member whose sparse map ends before its real size to cause a denial of service.
Extraction with the memory option is not affected.
3) Improper Validation of Consistency within Input (CVE-ID: CVE-2026-94200)
CWE-ID: CWE-1288 - Improper Validation of Consistency within Input
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a node-wide denial of service affecting SSL functionality.
The vulnerability exists due to improper validation of consistency within input in the node-global tls_client_ticket_store when automatically resuming TLS 1.3 sessions. A remote attacker can supply a crafted NewSessionTicket containing zero-length early_data to cause a node-wide denial of service affecting SSL functionality.
Exploitation requires a connection to a malicious or man-in-the-middle TLS server and automatic ticket handling with {session_tickets, auto} enabled.
Remediation
Install update from vendor's website.