Improper Input Validation in Erlang OTP SSL Module

CVE-2026-94200

What is CVE-2026-94200?

A vulnerability exists in the Erlang OTP ssl module, specifically within the tls_handshake_1_3, ssl_handshake, and tls_client_ticket_store components. This flaw allows a malicious TLS 1.3 server to exploit the improper handling of NewSessionTicket messages, which can lead to repeated crashes of the ssl application on the client node. When the client mistakenly decodes a 0-length early_data extension, it can trigger erroneous states that exceed the restart intensity of ssl supervisors, resulting in a complete denial of service for all ssl connections on the node. This issue affects multiple versions of OTP, highlighting the importance of prompt remediation.

References