Erlang/OTP’s ssl module incorrectly enforces message integrity when acting as a client. The function that processes protocol records does not reject pre‑handshake APPLICATION_DATA records in client mode, whereas it does in server mode, as defined by CWE‑924. As a result, a network‑positioned attacker can inject plaintext APPLICATION_DATA records during the TLS handshake. Those records are buffered and are later forwarded to the application under the false impression that they have been authenticated post‑handshake. Because the attacker cannot observe the client’s response or modify the connection, the flaw allows only blind injection of unauthenticated bytes, with a wider injection window on TLS versions prior to 1.3.

All Erlang/OTP releases from 17.0 up to but not including 29.0.3, including OTP 28.5.0.3 and OTP 27.3.4.14, and their corresponding ssl library versions prior to 11.7.3, 11.6.0.3, and 11.2.12.10, are vulnerable. The vulnerability also applies to the TLS 1.3 support added in OTP 22.0 until the patches are applied.

The CVSS score of 6.3 indicates a medium severity flaw that allows blind data injection but does not expose disclosure or remote code execution. The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, which suggests a low exploitation likelihood. An attacker must be in a position to inject packets during the TLS handshake; no client response or steering capability is required, making the attack surface narrow but still present for any exposed TLS endpoint.