Erlang/OTP: Critical TLS Impersonation and Two High Flaws Disclosed Together
Erlang/OTP faces a Critical and two High severity vulnerabilities disclosed on September 22, 2026, affecting TLS security and resource management.
Key findings
- Critical CVE-2026-89422 allows TLS 1.3 server impersonation due to flawed key exchange authentication.
- High severity CVE-2026-65634 enables DoS via crafted OID in ASN.1 decoder during TLS handshake.
- High severity CVE-2026-68956 permits memory exhaustion in SSH by opening unhandled session channels.
- All three vulnerabilities were disclosed together on September 22, 2026, impacting Erlang/OTP's ssl, ssh, and asn1 components.
On September 22, 2026, a batch of three vulnerabilities was disclosed for Erlang/OTP, the open-source runtime system for building scalable and robust applications. The vulnerabilities, ranging in severity from High to Critical, were all published on the same day, indicating a coordinated disclosure event. These flaws impact the security and stability of systems relying on Erlang/OTP, particularly those utilizing the ssl and ssh components, as well as the asn1 module.
Two of the vulnerabilities, CVE-2026-89422 and CVE-2026-65634, present significant security risks. CVE-2026-89422, a Critical severity vulnerability in the ssl component, is a Key Exchange without Entity Authentication flaw. It allows a malicious peer to impersonate the intended server during a TLS 1.3 client connection by exploiting a pre_shared_key extension in the ServerHello that the client did not offer. This could lead to man-in-the-middle attacks where clients unknowingly communicate with an attacker-controlled server.
CVE-2026-65634, a High severity vulnerability, affects the asn1 OBJECT IDENTIFIER decoder within Erlang/OTP. This flaw involves Inefficient algorithmic complexity, enabling an unauthenticated remote attacker to cause a denial of service (DoS) by sending a crafted Object Identifier (OID) during the TLS handshake. The vulnerability lies in the BER OID decoder, specifically in asn1rtt_ber:dec_subidentifiers/3 and its PER equivalent.
The third vulnerability, CVE-2026-68956, also rated High, impacts the ssh component. It is an Allocation of Resources Without Limits or Throttling vulnerability. An authenticated remote attacker can exploit this by repeatedly opening session channels that are never assigned a handler, leading to the exhaustion of node memory. The ssh_connection:handle_msg/4 function's "session" clause has a check for minimal_remote_max_packet_size that is insufficient to prevent this resource exhaustion.
These vulnerabilities highlight potential weaknesses in the security protocols and resource management within Erlang/OTP. The Critical severity of CVE-2026-89422 warrants immediate attention, as it directly impacts the confidentiality and integrity of TLS 1.3 communications. The DoS vulnerabilities (CVE-2026-65634 and CVE-2026-68956) pose a risk to the availability of services running on Erlang/OTP. Users are advised to consult the official Erlang/OTP advisories for specific version information and patching guidance.
The coordinated disclosure of these three vulnerabilities on the same day underscores the importance of timely patching and security updates for Erlang/OTP deployments. Organizations relying on this runtime system should prioritize assessing their exposure to these flaws and implementing the necessary security measures to mitigate potential risks.
Erlang/OTP users should review the specific details of each CVE to understand the precise impact on their systems and apply the relevant patches or workarounds as provided by the Erlang/OTP security team. Staying informed about such disclosures and maintaining a robust patch management strategy is crucial for safeguarding applications built with Erlang/OTP.