Erlang/OTP’s ssl module lacks a client‑side integrity check for APPLICATION_DATA records received before the TLS handshake finishes, a weakness classified as CWE‑924. A network‑positioned attacker can send plaintext records during the handshake that are buffered and later delivered to the client application as if they were authenticated post‑handshake data. The attacker cannot observe the client’s responses or steer the connection, so the impact is limited to blind injection of unauthenticated bytes.

Erlang/OTP releases from 17.0 up to but not including the fixed releases 29.0.3, 28.5.0.3, and 27.3.4.14, and the corresponding ssl library versions before 11.7.3, 11.6.0.3, and 11.2.12.10, are vulnerable. TLS 1.3 support, added in OTP 22.0, is also affected until the fix is applied.

The CVSS 3.0 classifies this as a medium‑severity flaw. An attacker must inject packets during the TLS handshake; no response or steering of the connection is required. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation. The flaw permits only blind data injection, without disclosure or remote code execution.