Is CVE-2026-94200 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94200 being exploited in the wild.

How severe is CVE-2026-94200?

Informational severity, published 14 October 2026.

Which products and versions are affected?

Erlang OTP 23.3 before 27.3.4.19, 28.x before 28.5.0.8, 29.x before 29.1.2.

How is CVE-2026-94200 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94200?

Check whether you run Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94200: Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket

CVE-2026-94200 · Severity: info · Published 2026-10-14

Erlang OTP's TLS 1.3 implementation incorrectly validates NewSessionTicket messages, allowing a malicious server to crash the session ticket store. By sending a specially crafted ticket, an attacker can cause the entire TLS stack on the affected node to fail, disrupting all encrypted connections until the application restarts.

Technologies: Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-94200 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94200 being exploited in the wild.
How severe is CVE-2026-94200?: Informational severity, published 14 October 2026.
Which products and versions are affected?: Erlang OTP 23.3 before 27.3.4.19, 28.x before 28.5.0.8, 29.x before 29.1.2.
Is there a fix for CVE-2026-94200?: Yes: fixed in OTP 27.3.4.19, OTP 28.5.0.8, OTP 29.1.2 (corresponding to ssl 11.2.12.14, 11.6.0.7, 11.7.8). Until then: Set {session_tickets, manual} or use the default {session_tickets, disabled} to disable automatic session ticket resumption on TLS 1.3 clients; only clients with automatic resumption enabled are vulnerable. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94200 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94200?: Check whether you run Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: OTP 27.3.4.19, OTP 28.5.0.8, OTP 29.1.2 (corresponding to ssl 11.2.12.14, 11.6.0.7, 11.7.8)

Set {session_tickets, manual} or use the default {session_tickets, disabled} to disable automatic session ticket resumption on TLS 1.3 clients; only clients with automatic resumption enabled are vulnerable.

Technical details

A TLS 1.3 client using session ticket auto-resumption mishandles NewSessionTicket extensions: it decodes them with the wrong message type (encrypted_extensions instead of new_session_ticket), accepting a malformed early_data extension. When resuming a session with this corrupt ticket, the get_max_early_data function crashes with a case_clause error. Repeated crashes trigger the supervisor's restart limit, taking down the entire SSL application; exploitation requires a controlled or impersonated server.

Affected products

Erlang OTP 23.3 before 27.3.4.19, 28.x before 28.5.0.8, 29.x before 29.1.2

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.