CVE-2026-94200
Description
A flaw was found in Erlang's SSL application. A malicious Transport Layer Security (TLS) server can cause a Denial of Service (DoS) across client connections by returning an improperly formatted session resumption ticket with an empty early data extension. When the client attempts to automatically resume the session, the malformed ticket triggers an unhandled error in the ticket store, causing it to crash. Repeated crashes exceed internal supervisor restart limits, resulting in the termination of the SSL service and disrupting all secure connections on the client node.
Statement
An improper input validation vulnerability was found in the ssl application of Erlang/OTP. A malicious TLS 1.3 server can supply an invalid zero-length early_data extension within a NewSessionTicket message, causing an unhandled case_clause crash in tls_client_ticket_store during automatic session resumption. Repeated crashes can exceed the supervisor restart intensity and terminate the entire ssl application on the client node, leading to a denial of service for all secure connections.
Mitigation
Disable automatic TLS session tickets on client connections by setting session_tickets => manual or session_tickets => disabled in the client SSL socket options.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
