{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["ssl_gen_statem","ssl_config","ssl_session","ssl_handshake"],"packageName":"otp","packageURL":"pkg:software-id/erlang.org/otp","product":"OTP","programFiles":["lib/ssl/src/ssl_gen_statem.erl","lib/ssl/src/ssl_config.erl","lib/ssl/src/ssl_session.erl","lib/ssl/src/ssl_handshake.erl"],"programRoutines":[{"name":"ssl_gen_statem:handle_sni_extension/2"},{"name":"ssl_gen_statem:handle_sni_hostname/2"},{"name":"ssl_gen_statem:update_ssl_options_from_sni/2"},{"name":"ssl_gen_statem:fallback_options/2"},{"name":"ssl_config:update_options/3"},{"name":"ssl_config:opt_reuse_sessions/3"},{"name":"ssl_session:server_select_session/5"},{"name":"ssl_session:is_resumable/4"},{"name":"ssl_session:reusable_options/2"},{"name":"ssl_handshake:select_session/8"}],"vendor":"Erlang","versions":[{"changes":[{"at":"27.3.4.19","status":"unaffected"},{"at":"28.5.0.8","status":"unaffected"},{"at":"29.1.2","status":"unaffected"}],"lessThan":"*","status":"affected","version":"18.0","versionType":"otp"}]},{"cpes":["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["ssl_gen_statem","ssl_config","ssl_session","ssl_handshake"],"packageName":"ssl","packageURL":"pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git","product":"OTP","programFiles":["src/ssl_gen_statem.erl","src/ssl_config.erl","src/ssl_session.erl","src/ssl_handshake.erl"],"programRoutines":[{"name":"ssl_gen_statem:handle_sni_extension/2"},{"name":"ssl_gen_statem:handle_sni_hostname/2"},{"name":"ssl_gen_statem:update_ssl_options_from_sni/2"},{"name":"ssl_gen_statem:fallback_options/2"},{"name":"ssl_config:update_options/3"},{"name":"ssl_config:opt_reuse_sessions/3"},{"name":"ssl_session:server_select_session/5"},{"name":"ssl_session:is_resumable/4"},{"name":"ssl_session:reusable_options/2"},{"name":"ssl_handshake:select_session/8"}],"repo":"https://github.com/erlang/otp","vendor":"Erlang","versions":[{"changes":[{"at":"11.2.12.14","status":"unaffected"},{"at":"11.6.0.7","status":"unaffected"},{"at":"11.7.8","status":"unaffected"}],"lessThan":"*","status":"affected","version":"7.0","versionType":"otp"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["ssl_gen_statem","ssl_config","ssl_session","ssl_handshake"],"packageName":"erlang/otp","packageURL":"pkg:github/erlang/otp","product":"OTP","programFiles":["lib/ssl/src/ssl_gen_statem.erl","lib/ssl/src/ssl_config.erl","lib/ssl/src/ssl_session.erl","lib/ssl/src/ssl_handshake.erl"],"programRoutines":[{"name":"ssl_gen_statem:handle_sni_extension/2"},{"name":"ssl_gen_statem:handle_sni_hostname/2"},{"name":"ssl_gen_statem:update_ssl_options_from_sni/2"},{"name":"ssl_gen_statem:fallback_options/2"},{"name":"ssl_config:update_options/3"},{"name":"ssl_config:opt_reuse_sessions/3"},{"name":"ssl_session:server_select_session/5"},{"name":"ssl_session:is_resumable/4"},{"name":"ssl_session:reusable_options/2"},{"name":"ssl_handshake:select_session/8"}],"repo":"https://github.com/erlang/otp","vendor":"Erlang","versions":[{"changes":[{"at":"0c20f3683b3c81fd30b46047195be9b3d2c69d76","status":"unaffected"},{"at":"4d76adbf39d547a931048544df09c3c087e56618","status":"unaffected"},{"at":"10ee925d0fee8413f1170cc21bfcf123c8d22454","status":"unaffected"}],"lessThan":"*","status":"affected","version":"4fe38c4b8b2c8024afb60990e598ff823743fd54","versionType":"git"}]}],"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

Exploitation requires all of the following. One TLS listener serves at least two SNI names through sni_fun or sni_hosts. The names use the same server certificate but select different client CAs with verify_peer. TLS 1.2 or earlier is enabled. No SNI option set sets reuse_sessions to false while the base listener's effective value is true, which is the default when the base listener uses verify_none. The attacker holds a client certificate that the lower-trust name accepts.

"},{"base64":false,"type":"text/markdown","value":"Exploitation requires all of the following. One TLS listener serves at least two SNI names through `sni_fun` or `sni_hosts`. The names use the same server certificate but select different client CAs with `verify_peer`. TLS 1.2 or earlier is enabled. No SNI option set sets `reuse_sessions` to false while the base listener's effective value is true, which is the default when the base listener uses `verify_none`. The attacker holds a client certificate that the lower-trust name accepts."}],"value":"Exploitation requires all of the following. One TLS listener serves at least two SNI names through sni_fun or sni_hosts. The names use the same server certificate but select different client CAs with verify_peer. TLS 1.2 or earlier is enabled. No SNI option set sets reuse_sessions to false while the base listener's effective value is true, which is the default when the base listener uses verify_none. The attacker holds a client certificate that the lower-trust name accepts."}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*","versionEndExcluding":"27.3.4.19","versionStartIncluding":"18.0","vulnerable":true},{"criteria":"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*","versionEndExcluding":"28.5.0.8","versionStartIncluding":"28.0","vulnerable":true},{"criteria":"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*","versionEndExcluding":"29.1.2","versionStartIncluding":"29.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}],"credits":[{"lang":"en","type":"finder","value":"Yonghwa Lee / Xint by Theori"},{"lang":"en","type":"reporter","value":"Yonghwa Lee / Xint by Theori"},{"lang":"en","type":"remediation developer","value":"Ingela Anderton Andin"}],"dateAssigned":"2026-10-08T15:40:48.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there.

\n

A server that serves several SNI names from one listen socket through sni_fun or sni_hosts keeps one pre-TLS 1.3 session cache per listener and does not bind a cached session to the SNI name or client trust policy that established it. When an SNI option set switches to verify_peer without naming reuse_sessions, ssl_config:update_options/3 inherits the base listener's reuse_sessions value of true, so the default that disables reuse for client-authenticating servers does not apply. On an abbreviated handshake ssl_session:is_resumable/4 checks only that the cached session uses one of the current server certificates and carries some peer certificate, and never revalidates that certificate against the CA selected for the requested name. The names must share a server certificate, which is common with wildcard or multi-SAN certificates. TLS 1.3 does not use this cache and is not affected.

\n

This issue affects OTP from OTP 18.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 7.0 before 11.2.12.14, 11.6.0.7, and 11.7.8.

"},{"base64":false,"type":"text/markdown","value":"Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there.\n\nA server that serves several SNI names from one listen socket through `sni_fun` or `sni_hosts` keeps one pre-TLS 1.3 session cache per listener and does not bind a cached session to the SNI name or client trust policy that established it. When an SNI option set switches to `verify_peer` without naming `reuse_sessions`, `ssl_config:update_options/3` inherits the base listener's `reuse_sessions` value of true, so the default that disables reuse for client-authenticating servers does not apply. On an abbreviated handshake `ssl_session:is_resumable/4` checks only that the cached session uses one of the current server certificates and carries some peer certificate, and never revalidates that certificate against the CA selected for the requested name. The names must share a server certificate, which is common with wildcard or multi-SAN certificates. TLS 1.3 does not use this cache and is not affected.\n\nThis issue affects OTP from OTP 18.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 7.0 before 11.2.12.14, 11.6.0.7, and 11.7.8."}],"value":"Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there.\n\nA server that serves several SNI names from one listen socket through sni_fun or sni_hosts keeps one pre-TLS 1.3 session cache per listener and does not bind a cached session to the SNI name or client trust policy that established it. When an SNI option set switches to verify_peer without naming reuse_sessions, ssl_config:update_options/3 inherits the base listener's reuse_sessions value of true, so the default that disables reuse for client-authenticating servers does not apply. On an abbreviated handshake ssl_session:is_resumable/4 checks only that the cached session uses one of the current server certificates and carries some peer certificate, and never revalidates that certificate against the CA selected for the requested name. The names must share a server certificate, which is common with wildcard or multi-SAN certificates. TLS 1.3 does not use this cache and is not affected.\n\nThis issue affects OTP from OTP 18.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 7.0 before 11.2.12.14, 11.6.0.7, and 11.7.8."}],"impacts":[{"capecId":"CAPEC-114","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

A client holding a certificate issued by the lower-trust SNI name's CA connects to the higher-trust name as a fully authenticated mTLS peer and obtains whatever that service grants on a successful client-certificate handshake. Multi-tenant or partner-facing listeners that separate trust domains by SNI name are affected.

"},{"base64":false,"type":"text/markdown","value":"A client holding a certificate issued by the lower-trust SNI name's CA connects to the higher-trust name as a fully authenticated mTLS peer and obtains whatever that service grants on a successful client-certificate handshake. Multi-tenant or partner-facing listeners that separate trust domains by SNI name are affected."}],"value":"A client holding a certificate issued by the lower-trust SNI name's CA connects to the higher-trust name as a fully authenticated mTLS peer and obtains whatever that service grants on a successful client-certificate handshake. Multi-tenant or partner-facing listeners that separate trust domains by SNI name are affected."}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6.3,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","description":"CWE-295 Improper Certificate Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-14T16:55:51.495Z","orgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","shortName":"EEF"},"references":[{"name":"GitHub Advisory","tags":["related","vendor-advisory"],"url":"https://github.com/erlang/otp/security/advisories/GHSA-2g23-cgjh-34gq"},{"name":"EEF CNA record for CVE-2026-105236","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-105236.html"},{"name":"OSV record EEF-CVE-2026-105236","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-105236"},{"name":"Erlang/OTP version ordering","tags":["x_version-scheme"],"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"name":"Introducing commit 4fe38c4 in erlang/otp","tags":["related"],"url":"https://github.com/erlang/otp/commit/4fe38c4b8b2c8024afb60990e598ff823743fd54"},{"name":"Fix commit 0c20f36 in erlang/otp","tags":["patch"],"url":"https://github.com/erlang/otp/commit/0c20f3683b3c81fd30b46047195be9b3d2c69d76"},{"name":"Fix commit 4d76adb in erlang/otp","tags":["patch"],"url":"https://github.com/erlang/otp/commit/4d76adbf39d547a931048544df09c3c087e56618"},{"name":"Fix commit 10ee925 in erlang/otp","tags":["patch"],"url":"https://github.com/erlang/otp/commit/10ee925d0fee8413f1170cc21bfcf123c8d22454"}],"source":{"discovery":"EXTERNAL"},"title":"TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":""},{"base64":false,"type":"text/markdown","value":"- Set `{reuse_sessions, false}` in each SNI service's option set, or in the base listener options. The reporter's proof of concept confirmed that this blocks the cross-name resumption.\n- Serve distinct SNI trust domains on separate listen sockets, which gives each its own session cache.\n- Restrict the listener to TLS 1.3 with `{versions, ['tlsv1.3']}`. TLS 1.3 does not use the session-ID cache."}],"value":"* Set {reuse_sessions, false} in each SNI service's option set, or in the base listener options. The reporter's proof of concept confirmed that this blocks the cross-name resumption.\n* Serve distinct SNI trust domains on separate listen sockets, which gives each its own session cache.\n* Restrict the listener to TLS 1.3 with {versions, ['tlsv1.3']}. TLS 1.3 does not use the session-ID cache."}],"x_proofOfConcept":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
    \n
  1. Create one server certificate with subject alternative names low.test and high.test, two self-signed client CAs (low-ca, high-ca), and one client certificate signed by low-ca.
    2. \n
  2. Start an ssl:listen/2 server on TLS 1.2 with {verify, verify_none} and an sni_fun that returns {verify, verify_peer}, {fail_if_no_peer_cert, true} and the low-ca or high-ca cacertfile for the respective name. Do not set reuse_sessions anywhere.
    3. \n
  3. Connect with openssl s_client -servername high.test -tls1_2 -no_ticket using the low client certificate. The server rejects the handshake with unknown_ca.
    4. \n
  4. Connect with -servername low.test and the same certificate, saving the session with -sess_out. The handshake succeeds.
    5. \n
  5. Connect with -servername high.test and -sess_in pointing at the saved session. The server resumes the session, ssl:connection_information/2 reports session_resumption true for high.test, and the application behind the protected name serves the request to a client whose certificate high-ca never issued.
    6. \n
"},{"base64":false,"type":"text/markdown","value":"1. Create one server certificate with subject alternative names `low.test` and `high.test`, two self-signed client CAs (`low-ca`, `high-ca`), and one client certificate signed by `low-ca`.\n2. Start an `ssl:listen/2` server on TLS 1.2 with `{verify, verify_none}` and an `sni_fun` that returns `{verify, verify_peer}`, `{fail_if_no_peer_cert, true}` and the `low-ca` or `high-ca` `cacertfile` for the respective name. Do not set `reuse_sessions` anywhere.\n3. Connect with `openssl s_client -servername high.test -tls1_2 -no_ticket` using the low client certificate. The server rejects the handshake with `unknown_ca`.\n4. Connect with `-servername low.test` and the same certificate, saving the session with `-sess_out`. The handshake succeeds.\n5. Connect with `-servername high.test` and `-sess_in` pointing at the saved session. The server resumes the session, `ssl:connection_information/2` reports `session_resumption` true for `high.test`, and the application behind the protected name serves the request to a client whose certificate `high-ca` never issued."}],"value":"* Create one server certificate with subject alternative names low.test and high.test, two self-signed client CAs (low-ca, high-ca), and one client certificate signed by low-ca.\n* Start an ssl:listen/2 server on TLS 1.2 with {verify, verify_none} and an sni_fun that returns {verify, verify_peer}, {fail_if_no_peer_cert, true} and the low-ca or high-ca cacertfile for the respective name. Do not set reuse_sessions anywhere.\n* Connect with openssl s_client -servername high.test -tls1_2 -no_ticket using the low client certificate. The server rejects the handshake with unknown_ca.\n* Connect with -servername low.test and the same certificate, saving the session with -sess_out. The handshake succeeds.\n* Connect with -servername high.test and -sess_in pointing at the saved session. The server resumes the session, ssl:connection_information/2 reports session_resumption true for high.test, and the application behind the protected name serves the request to a client whose certificate high-ca never issued."}],"x_technicalAnalysis":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

1. One session cache per listener. tls_socket:listen/3 starts one pre-TLS 1.3 session-ID tracker per listen socket via session_id_tracker/2. Every SNI virtual host served from that socket shares it, and the cached #session{} record stores the peer and server certificates but no SNI name and no client trust policy.

\n

2. The SNI option set inherits session reuse. When the ClientHello carries a server name, ssl_gen_statem:handle_sni_extension/2 and handle_sni_hostname/2 call update_ssl_options_from_sni/2, which passes the base listener options as fallback into ssl_config:update_options/3. The base listener's verify_none has already produced reuse_sessions = true. ssl_config:opt_reuse_sessions/3 computes a false default for verify_peer, but get_opt_bool/4 finds the inherited value and keeps it when the SNI option list does not mention reuse_sessions.

\n

3. Resumption does not revalidate the peer certificate. On an abbreviated handshake ssl_handshake:select_session/8 calls ssl_session:server_select_session/5, which accepts the cached session when ssl_session:is_resumable/4 finds that it is marked resumable, that is_owncert/2 matches one of the current server certificates, that reusable_options/2 sees any cached peer certificate when fail_if_no_peer_cert is set, and that the reuse_session fun agrees. Nothing compares the ClientHello server name with the name that created the session, and the cached peer certificate is not validated against the CA selected for the new name.

\n

4. Result. A client whose certificate chains to the lower-trust name's CA completes a full handshake there, then presents the same session ID with the higher-trust server name. The server resumes the session, reports session_resumption as true and the low-trust peer certificate through ssl:peercert/1, and the application behind the protected name sees an authenticated mTLS peer. is_owncert/2 is why both names must share a server certificate.

"},{"base64":false,"type":"text/markdown","value":"**1. One session cache per listener.** `tls_socket:listen/3` starts one pre-TLS 1.3 session-ID tracker per listen socket via `session_id_tracker/2`. Every SNI virtual host served from that socket shares it, and the cached `#session{}` record stores the peer and server certificates but no SNI name and no client trust policy.\n\n**2. The SNI option set inherits session reuse.** When the ClientHello carries a server name, `ssl_gen_statem:handle_sni_extension/2` and `handle_sni_hostname/2` call `update_ssl_options_from_sni/2`, which passes the base listener options as fallback into `ssl_config:update_options/3`. The base listener's `verify_none` has already produced `reuse_sessions = true`. `ssl_config:opt_reuse_sessions/3` computes a `false` default for `verify_peer`, but `get_opt_bool/4` finds the inherited value and keeps it when the SNI option list does not mention `reuse_sessions`.\n\n**3. Resumption does not revalidate the peer certificate.** On an abbreviated handshake `ssl_handshake:select_session/8` calls `ssl_session:server_select_session/5`, which accepts the cached session when `ssl_session:is_resumable/4` finds that it is marked resumable, that `is_owncert/2` matches one of the current server certificates, that `reusable_options/2` sees any cached peer certificate when `fail_if_no_peer_cert` is set, and that the `reuse_session` fun agrees. Nothing compares the ClientHello server name with the name that created the session, and the cached peer certificate is not validated against the CA selected for the new name.\n\n**4. Result.** A client whose certificate chains to the lower-trust name's CA completes a full handshake there, then presents the same session ID with the higher-trust server name. The server resumes the session, reports `session_resumption` as true and the low-trust peer certificate through `ssl:peercert/1`, and the application behind the protected name sees an authenticated mTLS peer. `is_owncert/2` is why both names must share a server certificate."}],"value":"1. One session cache per listener. tls_socket:listen/3 starts one pre-TLS 1.3 session-ID tracker per listen socket via session_id_tracker/2. Every SNI virtual host served from that socket shares it, and the cached #session{} record stores the peer and server certificates but no SNI name and no client trust policy.\n\n2. The SNI option set inherits session reuse. When the ClientHello carries a server name, ssl_gen_statem:handle_sni_extension/2 and handle_sni_hostname/2 call update_ssl_options_from_sni/2, which passes the base listener options as fallback into ssl_config:update_options/3. The base listener's verify_none has already produced reuse_sessions = true. ssl_config:opt_reuse_sessions/3 computes a false default for verify_peer, but get_opt_bool/4 finds the inherited value and keeps it when the SNI option list does not mention reuse_sessions.\n\n3. Resumption does not revalidate the peer certificate. On an abbreviated handshake ssl_handshake:select_session/8 calls ssl_session:server_select_session/5, which accepts the cached session when ssl_session:is_resumable/4 finds that it is marked resumable, that is_owncert/2 matches one of the current server certificates, that reusable_options/2 sees any cached peer certificate when fail_if_no_peer_cert is set, and that the reuse_session fun agrees. Nothing compares the ClientHello server name with the name that created the session, and the cached peer certificate is not validated against the CA selected for the new name.\n\n4. Result. A client whose certificate chains to the lower-trust name's CA completes a full handshake there, then presents the same session ID with the higher-trust server name. The server resumes the session, reports session_resumption as true and the low-trust peer certificate through ssl:peercert/1, and the application behind the protected name sees an authenticated mTLS peer. is_owncert/2 is why both names must share a server certificate."}]}},"cveMetadata":{"assignerOrgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","assignerShortName":"EEF","cveId":"CVE-2026-105236","datePublished":"2026-10-14T16:55:51.495Z","dateReserved":"2026-10-08T14:45:01.411Z","dateUpdated":"2026-10-14T16:55:51.495Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"}