CVE-2026-105236

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 18.0 through 27.3.4.18 Erlang/OTP versions 28.0 through 28.5.0.7 Erlang/OTP versions 29.0 through 29.1.1 ssl versions 7.0 through 11.2.12.13 ssl versions 11.6.0 through 11.6.0.6 ssl versions 11.7.0 through 11.7.7

Description Improper certificate validation in the ssl application allows a client with a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming a TLS 1.2 session. This occurs because servers using sni fun or sni hosts maintain a single pre-TLS 1.3 session cache per listener and do not bind cached sessions to specific SNI names or client trust policies. When ssl config:update options/3 is used, the reuse sessions value of true is inherited from the base listener, bypassing the default that disables reuse for client-authenticating servers. During an abbreviated handshake, the function ssl session:is resumable/4 fails to revalidate the peer certificate against the CA selected for the requested name. This issue requires the SNI names to share a server certificate, such as those using wildcard or multi-SAN certificates. TLS 1.3 is not affected as it does not use this cache.

Recommendations For Erlang/OTP versions 18.0 through 27.3.4.18, update to version 27.3.4.19. For Erlang/OTP versions 28.0 through 28.5.0.7, update to version 28.5.0.8. For Erlang/OTP versions 29.0 through 29.1.1, update to version 29.1.2. For ssl versions 7.0 through 11.2.12.13, update to version 11.2.12.14. For ssl versions 11.6.0 through 11.6.0.6, update to version 11.6.0.7. For ssl versions 11.7.0 through 11.7.7, update to version 11.7.8. Set {reuse sessions, false} in the base listener options or within each SNI service option set. Serve distinct SNI trust domains on separate listen sockets to ensure each has its own session cache. Restrict the listener to TLS 1.3 by configuring {versions, ['tlsv1.3']}.