PatchSiren cyber security CVE debrief

CVE-2026-105236 Erlang CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-14T16:55:51.495Z and has not been modified since then. The NVD entry is currently unclassified. This Improper Certificate Validation vulnerability in Erlang/OTP's ssl application allows unintended client authentication across SNI virtual hosts. A client with a certificate trusted by one SNI virtual host can authenticate to another SNI virtual host on the same listener by resuming its TLS 1.2 session. This issue affects deployments using TLS 1.2 session resumption with multiple SNI virtual hosts sharing a listener and client certificate trust boundaries.

Vendor: Erlang
Product: OTP
CVSS: MEDIUM 6.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-14
Original CVE updated: 2026-10-16
Advisory published: 2026-10-14
Advisory updated: 2026-10-16

Who should care

Erlang/OTP administrators and developers using TLS 1.2 session resumption with multiple SNI virtual hosts should assess exposure and prioritize updates to patched versions. Defenders should verify exposure, prioritize updates, and monitor usage. Security teams and vulnerability management teams should review and restrict SNI virtual host configurations to prevent unintended authentication.

Why it matters

CVE-2026-105236 allows unintended client authentication across SNI virtual hosts in Erlang/OTP, impacting deployments using TLS 1.2 session resumption. Defenders should verify exposure, prioritize updates, and monitor usage.

Potential for unintended client authentication across SNI virtual hosts
Possible bypass of client certificate validation for certain configurations
Need for verification of Erlang/OTP versions and SNI virtual host configurations
Importance of monitoring TLS session resumption usage in deployments

Technical summary

The Improper Certificate Validation vulnerability in Erlang/OTP's ssl application allows a client with a certificate trusted by one SNI virtual host to authenticate to another SNI virtual host on the same listener by resuming its TLS 1.2 session. This issue affects OTP from OTP versions prior to the patched releases. The vulnerability is due to the improper handling of TLS 1.2 session resumption across SNI virtual-host client-certificate trust boundaries. The names must share a server certificate, which is common with wildcard or multi-SAN certificates.

Defensive priority

Defenders should prioritize verifying exposure in Erlang/OTP deployments using TLS 1.2 session resumption, especially where multiple SNI virtual hosts share a listener and client certificate trust boundaries.

Recommended defensive actions

Verify and update Erlang/OTP versions to the latest patched releases
Review and restrict SNI virtual host configurations to prevent unintended authentication
Monitor and analyze TLS session resumption usage in Erlang/OTP deployments
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the Improper Certificate Validation vulnerability in Erlang/OTP's ssl application, affecting TLS 1.2 session resumption across SNI virtual-host client-certificate trust boundaries.

Sources and references

Verified primary and authoritative sources

CVE-2026-105236 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-105236

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-105236 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105236

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105236.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://github.com/erlang/otp/security/advisories/GHSA-2g23-cgjh-34gq

Supplemental source - related, vendor-advisory
Source reference
Unverified legacy reference

URL: https://cna.erlef.org/cves/CVE-2026-105236.html

Supplemental source - related
Source reference
Unverified legacy reference

URL: https://osv.dev/vulnerability/EEF-CVE-2026-105236

Supplemental source - related
Source reference
Unverified legacy reference

URL: https://www.erlang.org/doc/system/versions.html

Supplemental source - x_version-scheme
Source reference
Unverified legacy reference

URL: https://github.com/erlang/otp/commit/4fe38c4b8b2c8024afb60990e598ff823743fd54

Supplemental source - related
Source reference
Unverified legacy reference

URL: https://github.com/erlang/otp/commit/0c20f3683b3c81fd30b46047195be9b3d2c69d76

Supplemental source - patch
Source reference
Unverified legacy reference

URL: https://github.com/erlang/otp/commit/4d76adbf39d547a931048544df09c3c087e56618

Supplemental source - patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.