Improper Certificate Validation in Erlang/OTP SSL Application

CVE-2026-105236

What is CVE-2026-105236?

The Erlang/OTP SSL application exhibits an improper certificate validation vulnerability that allows a client, authenticated by a certificate from one SNI virtual host, to authenticate to an alternative SNI virtual host sharing the same listener. This occurs due to the server's implementation of session caching which does not enforce strict binding between cached sessions and the respective SNI name or client trust policy. The issue is particularly significant for server configurations using SNI options without appropriate session reuse controls, enabling the potential for unauthorized access. This vulnerability affects various versions of Erlang/OTP and the associated SSL library.

References