Improper Message Integrity in Erlang/OTP ssl Module Affects Client Applications

CVE-2026-54891

What is CVE-2026-54891?

The vulnerability related to the Erlang/OTP ssl module permits a network-positioned attacker to inject unauthenticated plaintext into a TLS client during the handshake process. Although the tls_gen_connection function safeguards against APPLICATION_DATA records in pre-handshake states for server endpoints, it fails to enforce the same restrictions for client endpoints. Consequently, attackers can send unauthorized APPLICATION_DATA that is then presented to the application as if it were legitimate post-handshake data. Although the vulnerability primarily allows blind injection of bytes, its impact varies depending on the version of TLS being utilized.

References