Erlang OTP TLS Certificate inet_tls_dist.erl comparison using wrong factors

Summaryinfo

A vulnerability categorized as problematic has been discovered in Erlang OTP. Impacted is an unknown function in the library lib/ssl/src/inet_tls_dist.erl of the component TLS Certificate Handler. Executing a manipulation can lead to comparison using wrong factors. This vulnerability is registered as CVE-2026-48860. The attack requires access to the local network. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Erlang OTP (affected version unknown) and classified as problematic. This vulnerability affects an unknown functionality in the library lib/ssl/src/inet_tls_dist.erl of the component TLS Certificate Handler. The manipulation with an unknown input leads to a comparison using wrong factors vulnerability. The CWE definition for the vulnerability is CWE-1025. The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before 29.0.2, 28.5.0.2 and 27.3.4.13 corresponding to ssl from 11.0 before 11.7.2, 11.6.0.2 and 11.2.12.9.

The weakness was published by Lukas Backström as GHSA-gp7x-mfv6-52cv. The advisory is available at github.com. This vulnerability was named CVE-2026-48860 since 05/25/2026. The exploitation appears to be difficult. The attack can only be done within the local network. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 320500 (Linux Distros Unpatched Vulnerability : CVE-2026-48860), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability. Applying the patch 0209a6df65d605552b378273027b3968b35f26b4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (320500). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Erlang

Name

• OTP

License

• open-source

Website

• Product: https://github.com/erlang/otp/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion