IT SBIT Services
Schneeberger
DEEN
CVE tracker

Erlang OTP ssl: Denial of service via malicious TLS 1.3 server ticket

CVE-2026-94200High 8.2

← All vulnerabilities

Summary

The ssl application of Erlang/OTP does not validate the message type of extensions in TLS 1.3 NewSessionTicket messages. A malicious TLS 1.3 server can send a malformed ticket that crashes the node-global session ticket store of a client. Repeated crashes can stop the ssl application for all TLS connections on that node. Only clients that set the option {session_tickets, auto} are affected, and the attacker must control or impersonate the server the client connects to.

Affected

  • Erlang/OTP 23.3 up to before 27.3.4.19
  • Erlang/OTP 28 up to before 28.5.0.8
  • Erlang/OTP 29 up to before 29.1.2
  • ssl application 10.3 up to before 11.2.12.14, 11.6.0.7 and 11.7.8
  • Only TLS 1.3 clients with {session_tickets, auto}

Fixed in

  • OTP 27.3.4.19, 28.5.0.8, 29.1.2
  • ssl 11.2.12.14, 11.6.0.7, 11.7.8
  • Linux distributions: use the distribution's package version

Workaround

  • Do not set {session_tickets, auto} on TLS 1.3 clients
  • Use manual ticket handling or keep the default (disabled)

Exploitation

  • No known exploitation in the wild at the time of writing
  • No public proof of concept known
  • CISA SSVC: exploitation none, automatable no, technical impact partial

Our recommendation

  • Update Erlang/OTP and the ssl application to the fixed versions, or install the fixed distribution packages
  • Identify Erlang-based software on your systems, for example RabbitMQ or ejabberd, and check its OTP version
  • Until patched, check whether {session_tickets, auto} is configured and disable it if it is not required
  • Priority: moderate, as the default configuration is not affected and no exploitation is known

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:17.

Original description (NVD)

Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node. This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.

NVD references (8)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed