Loading vulnerability…
TLS 1.3 server authentication bypass in Erlang/OTP ssl
CVE-2026-89422 is a server-authentication bypass in the Erlang/OTP ssl application's TLS 1.3 client implementation. tls_client_connection_1_3:handle_server_hello/2 passes an unsolicited pre_shared_key extension to tls_gen_connection_1_3:handle_resumption/2, which marks the connection as resumed without checking whether the client offered a PSK. Meanwhile, tls_handshake_1_3:get_pre_shared_key/4 falls back to the all-zero no-PSK value and the ordinary non-PSK key schedule, allowing the peer's own ephemeral key to suffice. The erroneous resumption state causes maybe_resumption/1 to transition directly to wait_finished, skipping certificate authentication. Consequently, ssl:connect can succeed against an impersonating peer without a certificate, server private key, or prior session. Affected releases begin with OTP 22.2, corresponding to ssl 9.5; fixed releases are OTP 27.3.4.18, 28.5.0.7, and 29.1.1 on their respective branches. Default TLS 1.3 client configurations are affected; TLS 1.2-only clients are not.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality and integrity of the affected TLS connection. An attacker can impersonate the intended server, read credentials, tokens, request bodies, and other application data, and forge server responses. The bypass skips certificate path validation, verify_fun processing, hostname verification, partial_chain handling, CRL checking, and OCSP stapling. Applications using ssl:connect, including HTTPS, database, messaging, and TLS distribution clients, can be affected. No direct availability impact is identified.
If you can’t patch tonight, do this now.
Until patched, restrict affected clients to TLS 1.2 by setting {versions, ['tlsv1.2']} in their ssl options. This avoids the vulnerable TLS 1.3 handshake path. No configuration-based workaround preserves TLS 1.3 while mitigating this vulnerability.
Patch, then assume compromise.
Upgrade to Erlang/OTP 27.3.4.18, 28.5.0.7, 29.1.1, or a later fixed release on the applicable branch. The corresponding fixed ssl versions are 11.2.12.13, 11.6.0.6, and 11.7.7. For Debian 13 (trixie), upgrade the erlang packages to 1:27.3.4.1+dfsg-1+deb13u4 or a later security-fixed package.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.