Description
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node.

The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node.

This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.
Published: 2026-10-14
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply patch
AI Analysis

Impact

The flaw is caused by the TLS 1.3 client treating a 0‑length early_data extension in a NewSessionTicket message as if it were part of EncryptedExtensions. Since this form is only valid in ClientHello and EncryptedExtensions, the client stores the malformed ticket in the global tls_client_ticket_store. On the next automatic resumption the function get_max_early_data/1 crashes with a case_clause, terminating the ssl application and all socket connections that use it.

Affected Systems

The vulnerable product is Erlang/OTP. Versions prior to OTP 27.3.4.19, OTP 28.5.0.8 and OTP 29.1.2—including ssl releases 10.3 before 11.2.12.14, 11.6.0.7 and 11.7.8—are affected. The issue is specific to the TLS 1.3 client handling logic in the otp ssl implementation.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity. The EPSS score of 0.00468 indicates a very low exploitation probability, though it is non‑zero, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can act as a malicious TLS 1.3 server that delivers a crafted NewSessionTicket containing a 0‑length early_data extension over a normal connection. Repeated crashes can exceed the restart intensity configured for ssl supervisors that use the rest_for_one strategy, causing a full node‑wide ssl outage.

Generated by OpenCVE AI on October 20, 2026 at 12:35 UTC.

Remediation

Vendor Workaround

Do not set {session_tickets, auto} on TLS 1.3 clients. Use manual ticket handling, or keep the default value disabled.

OpenCVE Recommended Actions

  • Update Erlang/OTP to a version where the ssl patch has been applied (e.g., OTP 27.3.4.19, OTP 28.5.0.8, or OTP 29.1.2 or later).
  • If an update is not feasible, configure the TLS client to disable automatic session ticket handling by setting {session_tickets, manual} or leaving it disabled.
  • If automatic session tickets cannot be disabled, increase the ssl supervisor restart intensity or change the restart strategy to one_for_one to isolate failures and prevent node‑wide ssl outages.

Generated by OpenCVE AI on October 20, 2026 at 12:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Vendors & Products Erlang erlang/otp

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-248
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 16 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node. This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.
Title TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-1288
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang/otp Erlang\/otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-10-16T20:09:04.559Z

Reserved: 2026-09-21T12:15:01.330Z

Link: CVE-2026-94200

cve-icon Vulnrichment

Updated: 2026-10-16T20:08:59.238Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T17:20:21.590

Modified: 2026-10-16T21:20:55.063

Link: CVE-2026-94200

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-14T16:55:23Z

Links: CVE-2026-94200 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T13:15:14Z

Weaknesses
  • CWE-1288

    Improper Validation of Consistency within Input

  • CWE-248

    Uncaught Exception