CVE-2026-94200 (GCVE-0-2026-94200)
Vulnerability from cvelistv5 – Published: 2026-10-14 16:55 – Updated: 2026-10-14 16:55
VLAI
EPSS
VEX
Title
TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl
Summary
Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node.
The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node.
This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.
Severity
CWE
- CWE-1288 - Improper Validation of Consistency within Input
Assigner
References
8 references
Impacted products
3 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Erlang | OTP |
Affected:
23.3 , < *
(otp)
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
||
| Erlang | OTP |
Affected:
10.3 , < *
(otp)
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
||
| Erlang | OTP |
Affected:
0abe6f66db0d295cd06b0efab3bdb3caa2803930 , < *
(git)
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl_handshake",
"tls_handshake_1_3",
"tls_client_ticket_store"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/ssl_handshake.erl",
"lib/ssl/src/tls_handshake_1_3.erl",
"lib/ssl/src/tls_client_ticket_store.erl"
],
"programRoutines": [
{
"name": "ssl_handshake:decode_extensions/4"
},
{
"name": "tls_handshake_1_3:decode_handshake/2"
},
{
"name": "tls_handshake_1_3:get_max_early_data/1"
},
{
"name": "tls_client_ticket_store:find_ticket/5"
},
{
"name": "tls_client_ticket_store:get_tickets/2"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "27.3.4.19",
"status": "unaffected"
},
{
"at": "28.5.0.8",
"status": "unaffected"
},
{
"at": "29.1.2",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "23.3",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl_handshake",
"tls_handshake_1_3",
"tls_client_ticket_store"
],
"packageName": "ssl",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssl_handshake.erl",
"src/tls_handshake_1_3.erl",
"src/tls_client_ticket_store.erl"
],
"programRoutines": [
{
"name": "ssl_handshake:decode_extensions/4"
},
{
"name": "tls_handshake_1_3:decode_handshake/2"
},
{
"name": "tls_handshake_1_3:get_max_early_data/1"
},
{
"name": "tls_client_ticket_store:find_ticket/5"
},
{
"name": "tls_client_ticket_store:get_tickets/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "11.2.12.14",
"status": "unaffected"
},
{
"at": "11.6.0.7",
"status": "unaffected"
},
{
"at": "11.7.8",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "10.3",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl_handshake",
"tls_handshake_1_3",
"tls_client_ticket_store"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/ssl_handshake.erl",
"lib/ssl/src/tls_handshake_1_3.erl",
"lib/ssl/src/tls_client_ticket_store.erl"
],
"programRoutines": [
{
"name": "ssl_handshake:decode_extensions/4"
},
{
"name": "tls_handshake_1_3:decode_handshake/2"
},
{
"name": "tls_handshake_1_3:get_max_early_data/1"
},
{
"name": "tls_client_ticket_store:find_ticket/5"
},
{
"name": "tls_client_ticket_store:get_tickets/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "66febc190e6dc42a5c4aedbfe250bf9a2edc2d5e",
"status": "unaffected"
},
{
"at": "00a333bcf2800b69f540369b54167e897dae7219",
"status": "unaffected"
},
{
"at": "cd0334854bf3ef56dc16f9fb728efe88fb05c4ac",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "0abe6f66db0d295cd06b0efab3bdb3caa2803930",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly TLS 1.3 clients that set the \u003ccode\u003essl\u003c/code\u003e option \u003ccode\u003e{session_tickets, auto}\u003c/code\u003e are affected. The default value of \u003ccode\u003esession_tickets\u003c/code\u003e is \u003ccode\u003edisabled\u003c/code\u003e, and clients that use \u003ccode\u003emanual\u003c/code\u003e ticket handling do not store tickets in the node-global ticket store. The client must also connect to a server that the attacker controls, or that the attacker can impersonate.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Only TLS 1.3 clients that set the `ssl` option `{session_tickets, auto}` are affected. The default value of `session_tickets` is `disabled`, and clients that use `manual` ticket handling do not store tickets in the node-global ticket store. The client must also connect to a server that the attacker controls, or that the attacker can impersonate."
}
],
"value": "Only TLS 1.3 clients that set the ssl option {session_tickets, auto} are affected. The default value of session_tickets is disabled, and clients that use manual ticket handling do not store tickets in the node-global ticket store. The client must also connect to a server that the attacker controls, or that the attacker can impersonate."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.19",
"versionStartIncluding": "23.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.8",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.1.2",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Lukas Backstr\u00f6m / Erlang Solutions"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ingela Anderton Andin"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-01T08:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Validation of Consistency within Input vulnerability in Erlang OTP ssl (\u003ccode\u003etls_handshake_1_3\u003c/code\u003e, \u003ccode\u003essl_handshake\u003c/code\u003e and \u003ccode\u003etls_client_ticket_store\u003c/code\u003e modules) allows a malicious TLS 1.3 server to cause a denial of service of the \u003ccode\u003essl\u003c/code\u003e application on the client node.\u003c/p\u003e\n\u003cp\u003eThe TLS 1.3 client decodes the extensions of a \u003ccode\u003eNewSessionTicket\u003c/code\u003e message as if they came from \u003ccode\u003eEncryptedExtensions\u003c/code\u003e. It therefore accepts a 0-length \u003ccode\u003eearly_data\u003c/code\u003e extension, a form that is only valid in \u003ccode\u003eClientHello\u003c/code\u003e and \u003ccode\u003eEncryptedExtensions\u003c/code\u003e. With \u003ccode\u003e{session_tickets, auto}\u003c/code\u003e, the client stores the ticket in the node-global \u003ccode\u003etls_client_ticket_store\u003c/code\u003e. On the next automatic resumption, \u003ccode\u003etls_handshake_1_3:get_max_early_data/1\u003c/code\u003e crashes the store with a \u003ccode\u003ecase_clause\u003c/code\u003e. Repeated crashes can exceed the restart intensity of the \u003ccode\u003essl\u003c/code\u003e supervisors, which use the \u003ccode\u003erest_for_one\u003c/code\u003e strategy, and take down \u003ccode\u003essl\u003c/code\u003e for all connections on the node.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;23.3 before OTP\u0026nbsp;27.3.4.19, OTP\u0026nbsp;28.5.0.8, and OTP\u0026nbsp;29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (`tls_handshake_1_3`, `ssl_handshake` and `tls_client_ticket_store` modules) allows a malicious TLS 1.3 server to cause a denial of service of the `ssl` application on the client node.\n\nThe TLS 1.3 client decodes the extensions of a `NewSessionTicket` message as if they came from `EncryptedExtensions`. It therefore accepts a 0-length `early_data` extension, a form that is only valid in `ClientHello` and `EncryptedExtensions`. With `{session_tickets, auto}`, the client stores the ticket in the node-global `tls_client_ticket_store`. On the next automatic resumption, `tls_handshake_1_3:get_max_early_data/1` crashes the store with a `case_clause`. Repeated crashes can exceed the restart intensity of the `ssl` supervisors, which use the `rest_for_one` strategy, and take down `ssl` for all connections on the node.\n\nThis issue affects OTP from OTP\u00a023.3 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8."
}
],
"value": "Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node.\n\nThe TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node.\n\nThis issue affects OTP from OTP\u00a023.3 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA malicious TLS 1.3 server can crash the client node\u0027s session ticket store, and by repeating the attack it can stop the \u003ccode\u003essl\u003c/code\u003e application for all TLS connections on that node. Only clients that use \u003ccode\u003e{session_tickets, auto}\u003c/code\u003e are affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A malicious TLS 1.3 server can crash the client node\u0027s session ticket store, and by repeating the attack it can stop the `ssl` application for all TLS connections on that node. Only clients that use `{session_tickets, auto}` are affected."
}
],
"value": "A malicious TLS 1.3 server can crash the client node\u0027s session ticket store, and by repeating the attack it can stop the ssl application for all TLS connections on that node. Only clients that use {session_tickets, auto} are affected."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1288",
"description": "CWE-1288 Improper Validation of Consistency within Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:55:23.328Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-m5mh-q53w-67jq"
},
{
"name": "EEF CNA record for CVE-2026-94200",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-94200.html"
},
{
"name": "OSV record EEF-CVE-2026-94200",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-94200"
},
{
"name": "Erlang/OTP version ordering",
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"name": "Introducing commit 0abe6f6 in erlang/otp",
"tags": [
"related"
],
"url": "https://github.com/erlang/otp/commit/0abe6f66db0d295cd06b0efab3bdb3caa2803930"
},
{
"name": "Fix commit 66febc1 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/66febc190e6dc42a5c4aedbfe250bf9a2edc2d5e"
},
{
"name": "Fix commit 00a333b in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/00a333bcf2800b69f540369b54167e897dae7219"
},
{
"name": "Fix commit cd03348 in erlang/otp",
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/cd0334854bf3ef56dc16f9fb728efe88fb05c4ac"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDo not set \u003ccode\u003e{session_tickets, auto}\u003c/code\u003e on TLS 1.3 clients. Use \u003ccode\u003emanual\u003c/code\u003e ticket handling, or keep the default value \u003ccode\u003edisabled\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Do not set `{session_tickets, auto}` on TLS 1.3 clients. Use `manual` ticket handling, or keep the default value `disabled`."
}
],
"value": "Do not set {session_tickets, auto} on TLS 1.3 clients. Use manual ticket handling, or keep the default value disabled."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Decoding.\u003c/strong\u003e \u003ccode\u003etls_handshake_1_3:decode_handshake/2\u003c/code\u003e decodes the extensions of a \u003ccode\u003eNewSessionTicket\u003c/code\u003e with the message type \u003ccode\u003eencrypted_extensions\u003c/code\u003e. \u003ccode\u003essl_handshake:decode_extensions/4\u003c/code\u003e does not check the message type for most extensions. A 0-length \u003ccode\u003eearly_data\u003c/code\u003e extension therefore decodes to \u003ccode\u003e#early_data_indication{}\u003c/code\u003e, the \u003ccode\u003eClientHello\u003c/code\u003e and \u003ccode\u003eEncryptedExtensions\u003c/code\u003e form, and not to \u003ccode\u003e#early_data_indication_nst{}\u003c/code\u003e, the 4-byte \u003ccode\u003emax_early_data_size\u003c/code\u003e form that RFC 8446 requires in a \u003ccode\u003eNewSessionTicket\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Storage.\u003c/strong\u003e In \u003ccode\u003eauto\u003c/code\u003e mode the client sends the ticket to the node-global \u003ccode\u003etls_client_ticket_store\u003c/code\u003e gen_server, which keeps it for later resumption.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Crash.\u003c/strong\u003e When a later connection resumes automatically, the store calls \u003ccode\u003etls_handshake_1_3:get_max_early_data/1\u003c/code\u003e on the stored extensions, from \u003ccode\u003emaybe_use_ticket\u003c/code\u003e and \u003ccode\u003eget_tickets\u003c/code\u003e. That function only handles \u003ccode\u003eundefined\u003c/code\u003e and \u003ccode\u003e#early_data_indication_nst{}\u003c/code\u003e, so the store process crashes with a \u003ccode\u003ecase_clause\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Escalation.\u003c/strong\u003e The store is a \u003ccode\u003epermanent\u003c/code\u003e child of \u003ccode\u003essl_admin_sup\u003c/code\u003e. Each restart of the store also restarts the children after it, because the supervisor uses \u003ccode\u003erest_for_one\u003c/code\u003e. A server that keeps sending the malformed ticket makes the crashes repeat. When the crashes exceed the supervisor restart intensity, the failure goes up through \u003ccode\u003essl_sup\u003c/code\u003e and stops the \u003ccode\u003essl\u003c/code\u003e application for the whole node.\u003c/p\u003e\n\u003cp\u003eThe fix makes \u003ccode\u003essl_handshake:decode_extensions/4\u003c/code\u003e accept each extension form only in the handshake messages where it is permitted, and decodes \u003ccode\u003eNewSessionTicket\u003c/code\u003e extensions with the message type \u003ccode\u003enew_session_ticket\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Decoding.** `tls_handshake_1_3:decode_handshake/2` decodes the extensions of a `NewSessionTicket` with the message type `encrypted_extensions`. `ssl_handshake:decode_extensions/4` does not check the message type for most extensions. A 0-length `early_data` extension therefore decodes to `#early_data_indication{}`, the `ClientHello` and `EncryptedExtensions` form, and not to `#early_data_indication_nst{}`, the 4-byte `max_early_data_size` form that RFC 8446 requires in a `NewSessionTicket`.\n\n**2. Storage.** In `auto` mode the client sends the ticket to the node-global `tls_client_ticket_store` gen_server, which keeps it for later resumption.\n\n**3. Crash.** When a later connection resumes automatically, the store calls `tls_handshake_1_3:get_max_early_data/1` on the stored extensions, from `maybe_use_ticket` and `get_tickets`. That function only handles `undefined` and `#early_data_indication_nst{}`, so the store process crashes with a `case_clause`.\n\n**4. Escalation.** The store is a `permanent` child of `ssl_admin_sup`. Each restart of the store also restarts the children after it, because the supervisor uses `rest_for_one`. A server that keeps sending the malformed ticket makes the crashes repeat. When the crashes exceed the supervisor restart intensity, the failure goes up through `ssl_sup` and stops the `ssl` application for the whole node.\n\nThe fix makes `ssl_handshake:decode_extensions/4` accept each extension form only in the handshake messages where it is permitted, and decodes `NewSessionTicket` extensions with the message type `new_session_ticket`."
}
],
"value": "1. Decoding. tls_handshake_1_3:decode_handshake/2 decodes the extensions of a NewSessionTicket with the message type encrypted_extensions. ssl_handshake:decode_extensions/4 does not check the message type for most extensions. A 0-length early_data extension therefore decodes to #early_data_indication{}, the ClientHello and EncryptedExtensions form, and not to #early_data_indication_nst{}, the 4-byte max_early_data_size form that RFC 8446 requires in a NewSessionTicket.\n\n2. Storage. In auto mode the client sends the ticket to the node-global tls_client_ticket_store gen_server, which keeps it for later resumption.\n\n3. Crash. When a later connection resumes automatically, the store calls tls_handshake_1_3:get_max_early_data/1 on the stored extensions, from maybe_use_ticket and get_tickets. That function only handles undefined and #early_data_indication_nst{}, so the store process crashes with a case_clause.\n\n4. Escalation. The store is a permanent child of ssl_admin_sup. Each restart of the store also restarts the children after it, because the supervisor uses rest_for_one. A server that keeps sending the malformed ticket makes the crashes repeat. When the crashes exceed the supervisor restart intensity, the failure goes up through ssl_sup and stops the ssl application for the whole node.\n\nThe fix makes ssl_handshake:decode_extensions/4 accept each extension form only in the handshake messages where it is permitted, and decodes NewSessionTicket extensions with the message type new_session_ticket."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-94200",
"datePublished": "2026-10-14T16:55:23.328Z",
"dateReserved": "2026-09-21T12:15:01.330Z",
"dateUpdated": "2026-10-14T16:55:23.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-94200",
"date": "2026-10-15",
"epss": "0.00468",
"percentile": "0.39047"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl_handshake",
"tls_handshake_1_3",
"tls_client_ticket_store"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/ssl_handshake.erl",
"lib/ssl/src/tls_handshake_1_3.erl",
"lib/ssl/src/tls_client_ticket_store.erl"
],
"programRoutines": [
{
"name": "ssl_handshake:decode_extensions/4"
},
{
"name": "tls_handshake_1_3:decode_handshake/2"
},
{
"name": "tls_handshake_1_3:get_max_early_data/1"
},
{
"name": "tls_client_ticket_store:find_ticket/5"
},
{
"name": "tls_client_ticket_store:get_tickets/2"
}
],
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "27.3.4.19",
"status": "unaffected"
},
{
"at": "28.5.0.8",
"status": "unaffected"
},
{
"at": "29.1.2",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "23.3",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl_handshake",
"tls_handshake_1_3",
"tls_client_ticket_store"
],
"packageName": "ssl",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/ssl_handshake.erl",
"src/tls_handshake_1_3.erl",
"src/tls_client_ticket_store.erl"
],
"programRoutines": [
{
"name": "ssl_handshake:decode_extensions/4"
},
{
"name": "tls_handshake_1_3:decode_handshake/2"
},
{
"name": "tls_handshake_1_3:get_max_early_data/1"
},
{
"name": "tls_client_ticket_store:find_ticket/5"
},
{
"name": "tls_client_ticket_store:get_tickets/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "11.2.12.14",
"status": "unaffected"
},
{
"at": "11.6.0.7",
"status": "unaffected"
},
{
"at": "11.7.8",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "10.3",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"ssl_handshake",
"tls_handshake_1_3",
"tls_client_ticket_store"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/ssl_handshake.erl",
"lib/ssl/src/tls_handshake_1_3.erl",
"lib/ssl/src/tls_client_ticket_store.erl"
],
"programRoutines": [
{
"name": "ssl_handshake:decode_extensions/4"
},
{
"name": "tls_handshake_1_3:decode_handshake/2"
},
{
"name": "tls_handshake_1_3:get_max_early_data/1"
},
{
"name": "tls_client_ticket_store:find_ticket/5"
},
{
"name": "tls_client_ticket_store:get_tickets/2"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "66febc190e6dc42a5c4aedbfe250bf9a2edc2d5e",
"status": "unaffected"
},
{
"at": "00a333bcf2800b69f540369b54167e897dae7219",
"status": "unaffected"
},
{
"at": "cd0334854bf3ef56dc16f9fb728efe88fb05c4ac",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "0abe6f66db0d295cd06b0efab3bdb3caa2803930",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node.\n\nThe TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node.\n\nThis issue affects OTP from OTP\u00a023.3 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8."
}
],
"id": "CVE-2026-94200",
"lastModified": "2026-10-15T14:45:10.783",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
},
"published": "2026-10-14T17:20:21.590",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://cna.erlef.org/cves/CVE-2026-94200.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/erlang/otp/commit/00a333bcf2800b69f540369b54167e897dae7219"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/erlang/otp/commit/0abe6f66db0d295cd06b0efab3bdb3caa2803930"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/erlang/otp/commit/66febc190e6dc42a5c4aedbfe250bf9a2edc2d5e"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/erlang/otp/commit/cd0334854bf3ef56dc16f9fb728efe88fb05c4ac"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/erlang/otp/security/advisories/GHSA-m5mh-q53w-67jq"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-94200"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1288"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.