CVE-2026-105236

A moderate-impact flaw in the Erlang/OTP ssl application affects the erlang27 package in Red Hat Hardened Images. An Erlang/OTP TLS server that serves several SNI virtual hosts from a single listen socket (through sni_fun or sni_hosts) keeps one pre-TLS 1.3 session cache per listener and does not bind a cached session to the SNI name or client trust policy that established it. A remote attacker who holds a client certificate trusted by one SNI virtual host can resume that TLS 1.2 session against a different SNI virtual host on the same listener that shares the same server certificate, bypassing revalidation of the client certificate against the target host's certificate authority (CA) and gaining unauthorized access to protected services. Exploitation requires a specific configuration: at least two SNI names on one listener that share a server certificate (common with wildcard or multi-SAN certificates) while using distinct client CAs, TLS 1.2 negotiation, session reuse enabled, and a valid client certificate for one of the virtual hosts. TLS 1.3 is not affected because it does not use this session cache. The affected Red Hat Hardened Images component is AFFECTED with a delegated resolution, so a fix is being pursued through that maintenance stream. Red Hat rates this flaw moderate severity with a CVSS 3.1 score of 4.8, lower than the upstream CVSS 4.0 score of 6.3, because successful exploitation depends on the specific multi-virtual-host configuration described above.