Executive brief
Erlang/OTP's TLS implementation for encrypted network connections contains a critical flaw in TLS 1.3 client handshaking that allows an attacker to impersonate any server. A malicious or compromised peer can complete the connection without presenting a valid certificate, gaining the ability to read all transmitted data (credentials, tokens, requests) and forge responses. Any application using Erlang/OTP's ssl module for HTTPS, database, messaging, or distributed node connections is affected unless restricted to TLS 1.2.
Technical details
The vulnerability stems from improper validation of the pre_shared_key extension in TLS 1.3 ServerHello messages. When a TLS 1.3 client receives an unsolicited PSK extension (which it never offered), the ssl module incorrectly sets a resumption flag and skips all certificate validation states including path validation, hostname verification, CRL checking, and OCSP stapling. An attacker only needs the client's ephemeral key to derive correct handshake keys, requiring no certificate or prior session. Affected versions are Erlang/OTP 22.2 through 27.x, 28.x, and 29.x; TLS 1.2 clients are unaffected.
Affected products
- Erlang OTP 22.2 to 27.3.4.17, 28.0.0 to 28.5.0.6, 29.0.0 to 29.1.0
- Erlang ssl 9.5 to 11.2.12.12, 11.6.0.0 to 11.6.0.5, 11.7.0 to 11.7.6
Timeline
- 2026-09-22: disclosed