Prior to version 1.4.4, the erlang_quic QUIC client performed TLS 1.3 handshakes without validating the server’s CertificateVerify signature, certificate chain, or hostname. As a result, the client effectively accepted any presented certificate, enabling an attacker on the network path to impersonate any server and compromise both confidentiality and integrity of the connection. The vulnerability also applies to HTTP/3 clients that use the same library. Handshakes that use a pre‑shared key (PSK) are unaffected because no certificate is transmitted during session resumption.

The vulnerable code is part of the erlang_quic project maintained by benoitc. Versions prior to 1.4.4 are affected. The same issue applies to any QUIC client that uses this library, including implementations of HTTP/3 that rely on it. Users of erlang_quic should verify that they are not deploying versions earlier than 1.4.4.

The CVSS score of 9.1 classifies this vulnerability as critical. The EPSS score is not available, but the lack of certificate validation provides a straightforward attack vector for a remote attacker who can position themselves between a client and a legitimate server. The vulnerability is not listed in the CISA KEV catalog, yet the simplicity of the exploit and the severity of the impact suggest a high likelihood of real‑world exploitation. An attacker could intercept and modify traffic, decrypt data, or inject malicious commands without detection.