CVE-2026-49457

Name of the Vulnerable Software and Affected Versions erlang quic versions prior to 1.4.4

Description The QUIC client fails to authenticate the server during the TLS 1.3 handshake. Specifically, the CertificateVerify signature is not checked, the certificate chain is not validated, and the hostname is not compared against the certificate, rendering the verify variable ineffective. This allows a man-in-the-middle attacker to present any certificate and impersonate any server, compromising the confidentiality and integrity of the connection. HTTP/3 is also affected as it utilizes the same client. Handshakes authenticated by a Pre-Shared Key (PSK) for session resumption are not affected because the peer is authenticated by the PSK binder and no certificate is transmitted.

Recommendations Update erlang quic to version 1.4.4.