Erlang QUIC Implementation Vulnerability in TLS Handshake by Benoit C.
CVE-2026-49457

9.1CRITICAL

Key Information:

Vendor

Benoitc

Status
Erlang Quic
Vendor
CVE Published:
14 August 2026

What is CVE-2026-49457?

The Erlang QUIC implementation prior to version 1.4.4 had a significant vulnerability where the client failed to authenticate the server during the TLS 1.3 handshake process. This oversight allowed a man-in-the-middle attacker to present any certificate, potentially impersonating any server, and jeopardizing both the confidentiality and integrity of the connection. As a result, both QUIC and HTTP/3 protocols were susceptible to this issue. The vulnerability was resolved in version 1.4.4, which introduced essential checks for the CertificateVerify signature, certificate chain validation against the trusted store, and hostname comparison to ensure secure communication.

Affected Version(s)

erlang_quic < 1.4.4

References

https://github.com/benoitc/erlang_quic/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.