# CVE-2026-49457: Benoitc erlang_quic improper TLS certificate verification

Source: https://junglewise.ai/threats/cve-2026-49457-benoitc-erlang-quic-improper-tls-certificate-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-49457 · Severity: critical · CVSS 9.1 · Published 2026-08-14

The erlang_quic library, which provides QUIC and HTTP/3 protocol support, failed to properly verify security certificates during encrypted connections. This allows an attacker positioned on the network to impersonate legitimate servers and intercept or modify sensitive data. Organizations using this library for secure communications are at risk of data exposure and loss of connection integrity.

Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-49457 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49457 being exploited in the wild.

**How severe is CVE-2026-49457?** Critical severity, with a CVSS score of 9.1, published 14 August 2026.

**Which products and versions are affected?** Erlang Quic <= 1.4.3.

**Is there a fix for CVE-2026-49457?** A patch was published on 2026-07-01: Fixed in version 1.4.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49457 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49457?** Check whether you run Erlang Quic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The erlang_quic client suffered from improper certificate validation (CWE-295) and improper validation of certificate hostnames (CWE-297) during TLS 1.3 handshakes. Specifically, the CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate. A network-positioned attacker (Man-in-the-Middle) could present any certificate to impersonate a server, compromising confidentiality and integrity. This affected both QUIC and HTTP/3 clients, though handshakes using Pre-Shared Keys (PSK) for session resumption were not impacted. The issue is fixed in version 1.4.4, which enables verification by default.

## Affected products

- benoitc/erlang_quic quic <= 1.4.3

## Identifiers

- CVE-2026-49457
- GHSA-2r8v-p65x-3663

## Timeline

- 2026-05-27: disclosed: Initial report to developer
- 2026-07-01: advisory: GitHub Advisory published
- 2026-07-01: patched: Fixed in version 1.4.4

## References

- [https://api.github.com/users/benmmurphy](https://api.github.com/users/benmmurphy)
- [https://github.com/benmmurphy](https://github.com/benmmurphy)
- [https://api.github.com/users/benmmurphy/gists%7B/gist_id%7D](https://api.github.com/users/benmmurphy/gists%7B/gist_id%7D)
- [https://api.github.com/users/benmmurphy/repos](https://api.github.com/users/benmmurphy/repos)
- [https://avatars.githubusercontent.com/u/392520?v=4](https://avatars.githubusercontent.com/u/392520?v=4)
- [https://api.github.com/users/benmmurphy/events%7B/privacy%7D](https://api.github.com/users/benmmurphy/events%7B/privacy%7D)