Erlang/OTP’s ssl module incorrectly enforces message integrity when acting as a client. The function tls_gen_connection:handle_protocol_record/3 rejects pre‑handshake APPLICATION_DATA records in server mode but not in client mode, as specified by CWE-924. Consequently, an attacker positioned on the network can inject plaintext APPLICATION_DATA records during the TLS handshake. These records are buffered and later forwarded to the application as if they were authenticated post‑handshake data. Because the attacker cannot observe the client’s response or modify the connection, the flaw permits only blind injection of unauthenticated bytes, with a wider injection window on TLS versions before 1.3. The vulnerability resides in lib/ssl/src/tls_gen_connection.erl.

OTP versions prior to 27.3.4.14, 28.5.0.3, and 29.0.3, and their matching ssl releases prior to 11.2.12.10, 11.6.0.3, and 11.7.3, are vulnerable. The TLS 1.3 support added in OTP 22.0 is also affected until the patches are applied.

The CVSS score of 6.3 indicates a medium severity flaw that allows blind data injection but does not expose disclosure or remote code execution. The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, which suggests a low exploitation likelihood. An attacker must be in a position to inject packets during the TLS handshake; no client response or steering capability is required, making the attack surface narrow but still present for any exposed TLS endpoint.