Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105236— TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries

Quick assessment

Affected
Erlang OTP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang/OTP 中 ssl 应用程序存在证书验证不当（Improper Certificate Validation）漏洞，使得持有被某个 SNI（服务器名称指示）虚拟主机信任的证书客户端，可以通过在该第二个 SNI 虚拟主机上恢复其 TLS 1.2 会话的方式实现身份认证。 当服务器通过 或 从单个监听套接字服务多个 SNI 名称时，每个监听器仅维护一个基于预 TLS 1.3 的会话缓存，且不会将缓存的会话绑定到建立它时所依据的 SNI 名称或客户端信任策略。当 SNI 选项集切换到 但未显式命名 时， 会

CVSS 6.3 · Medium EPSS 0.36% · P29

Affected Version Matrix 3

VendorProduct Version RangeStatus
Erlang OTP 18.0< * affected
7.0< * affected
4fe38c4b8b2c8024afb60990e598ff823743fd54< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105236

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI names from one listen socket through sni_fun or sni_hosts keeps one pre-TLS 1.3 session cache per listener and does not bind a cached session to the SNI name or client trust policy that established it. When an SNI option set switches to verify_peer without naming reuse_sessions, ssl_config:update_options/3 inherits the base listener's reuse_sessions value of true, so the default that disables reuse for client-authenticating servers does not apply. On an abbreviated handshake ssl_session:is_resumable/4 checks only that the cached session uses one of the current server certificates and carries some peer certificate, and never revalidates that certificate against the CA selected for the requested name. The names must share a server certificate, which is common with wildcard or multi-SAN certificates. TLS 1.3 does not use this cache and is not affected. This issue affects OTP from OTP 18.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 7.0 before 11.2.12.14, 11.6.0.7, and 11.7.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Erlang OTP 18.0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 7.0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 4fe38c4b8b2c8024afb60990e598ff823743fd54 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-105236

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105236

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-105236 (1)

Other References for CVE-2026-105236 (3)

Same Patch Batch · Erlang · 2026-10-14 · 3 CVEs total

CVE-2026-94200 8.2 HIGH TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in
CVE-2026-96596 5.9 MEDIUM erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

IV. Related Vulnerabilities

Same product: OTP
Same vendor: Erlang
Same weakness: CWE-295

V. Comments for CVE-2026-105236

No comments yet

Leave a comment