Vulnerability in Erlang/OTP SSL Application affecting TLS 1.3 Server

CVE-2026-55952

What is CVE-2026-55952?

The Erlang/OTP SSL application contains an input validation flaw that allows unauthenticated remote attackers to send a maliciously crafted ClientHello message to a TLS 1.3 server. This issue arises when the pre-shared key identity and binder lists are not of equal length. As a result, when the server processes this mismatched data, it crashes the session ticket handler, leaving the affected listener impaired until the ssl application is restarted. Connections using TLS 1.2 remain unaffected, but the flaw poses significant disruptions for TLS 1.3 operations, potentially halting secure communication.

References