Improper Enforcement of Message Integrity During Transmission in a Communication Channel in otp - CVE-2026-54891

Vulnerability identifier: #VU136825

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-54891

CWE-ID: CWE-924

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to inject plaintext data into a TLS client application.

The vulnerability exists due to improper enforcement of message integrity during transmission in the (d)tls client handshake handling when a man-in-the-middle interferes before the handshake completes. A remote attacker can inject plaintext data before handshake completion to inject plaintext data into a TLS client application.

The injected data may be delivered to the client application after a successful handshake. The injection window is smaller for TLS 1.3 than for earlier TLS versions.

otp
openEuler
Fedora
erlang-compiler
erlang-reltool
erlang-public_key
erlang-parsetools
erlang-os_mon
erlang-odbc
erlang-observer
erlang-mnesia
erlang-megaco
erlang-kernel
erlang-jinterface
erlang-inets
erlang-hipe
erlang
erlang-asn1
erlang-common_test
erlang-runtime_tools
erlang-crypto
erlang-debugger
erlang-debuginfo
erlang-debugsource
erlang-dialyzer
erlang-diameter
erlang-edoc
erlang-eldap
erlang-erl_docgen
erlang-erl_interface
erlang-erts
erlang-et
erlang-eunit
erlang-examples
erlang-ftp
erlang-sasl
erlang-xmerl
erlang-wx
erlang-tools
erlang-tftp
erlang-syntax_tools
erlang-stdlib
erlang-ssl
erlang-ssh
erlang-snmp
erlang-src

Install security update from vendor's website.

otp - addressed in versions 27.3.4.14, 28.5.0.3, 29.0.3
erlang-compiler - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-reltool - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-public_key - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-parsetools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-os_mon - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-odbc - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-observer - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-mnesia - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-megaco - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-kernel - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-jinterface - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-inets - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-hipe - update to 23.3.4.9-11
erlang - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-asn1 - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-common_test - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-runtime_tools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-crypto - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-debugger - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-debuginfo - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-debugsource - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-dialyzer - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-diameter - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-edoc - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-eldap - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-erl_docgen - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-erl_interface - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-erts - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-et - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-eunit - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-examples - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-ftp - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-sasl - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-xmerl - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-wx - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-tools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-tftp - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-syntax_tools - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-stdlib - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-ssl - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-ssh - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-snmp - addressed in versions 23.3.4.9-11, 25.3.2.6-18
erlang-src - update to 25.3.2.6-18
erlang - addressed in versions 26.2.5.21-4.fc43, 26.2.5.21-4.fc44

• https://github.com/erlang/otp/security/advisories/GHSA-gf6r-99xw-6qg6

• Multiple vulnerabilities in otp
• Fedora 44 update for erlang
• Fedora 43 update for erlang
• openEuler 24.03 LTS SP1 update for erlang
• openEuler 22.03 LTS SP4 update for erlang
• openEuler 24.03 LTS SP4 update for erlang
• openEuler 24.03 LTS SP3 update for erlang