Erlang OTP prior 27.3.4.15/28.5.0.4/29.0.4 Client Handshake ssl_handshake:handle_server_hello_extensions/9 certificate validation

Summaryinfo

A vulnerability was found in Erlang OTP. It has been declared as problematic. This impacts the function ssl_handshake:handle_server_hello_extensions/9 of the component Client Handshake. Such manipulation leads to certificate validation. This vulnerability is referenced as CVE-2026-55953. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Erlang OTP. It has been rated as problematic. Affected by this issue is the function ssl_handshake:handle_server_hello_extensions/9 of the component Client Handshake. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is integrity. CVE summarizes:

The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from 17.0 before 27.3.4.15, 28.5.0.4, and 29.0.4 corresponding to ssl from 5.3.4 before 11.2.12.11, 11.6.0.4, and 11.7.4.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-55953 since 06/17/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1587.003.

The vulnerability scanner Nessus provides a plugin with the ID 333501 (Fedora 44 : erlang (2026-7a3db128e8)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 27.3.4.15, 28.5.0.4 or 29.0.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (333501). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Erlang

Name

• OTP

Website

• Product: https://github.com/erlang/otp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion