CVE-2026-94200 Details
Description
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node. This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.
A denial-of-service vulnerability has been identified in the Erlang OTP SSL application, specifically within the TLS 1.3 handshake modules. This issue arises from improper validation of the 'early_data' extension in 'NewSessionTicket' messages, allowing a malicious TLS 1.3 server to crash the client's session ticket store. The vulnerability affects Erlang OTP versions 23.3 prior to 27.3.4.19, 28.5.0.8, and 29.1.2, corresponding to SSL versions 10.3 prior to 11.2.12.14, 11.6.0.7, and 11.7.8.
The vulnerability can be mitigated by disabling automatic session ticket handling on TLS 1.3 clients. Instead, use manual ticket management or leave the session tickets option turned off, which is the default setting.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-94200.html | EEF | AdvisoryTechnical Analysis |
| https://github.com/erlang/otp/commit/00a333bcf2800b69f540369b54167e897dae7219 | EEF | Source CodeVendor |
| https://github.com/erlang/otp/commit/0abe6f66db0d295cd06b0efab3bdb3caa2803930 | EEF | Source CodeVendor |
| https://github.com/erlang/otp/commit/66febc190e6dc42a5c4aedbfe250bf9a2edc2d5e | EEF | Source CodeVendor |
| https://github.com/erlang/otp/commit/cd0334854bf3ef56dc16f9fb728efe88fb05c4ac | EEF | Source CodeVendor |
| https://github.com/erlang/otp/security/advisories/GHSA-m5mh-q53w-67jq | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-94200 | EEF | AdvisoryTechnical Analysis |
| https://www.erlang.org/doc/system/versions.html#order-of-versions | EEF | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1288 | Improper Validation of Consistency within Input | EEF |
Affected Products
| Product | Versions |
|---|---|
| Erlang OTP | >= 23.3, < 27.3.4.19 >= 28.5.0.8 >= 29.1.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | EEF |