CVE-2026-94200 Erlang CVE debrief

Who should care

Defenders of TLS 1.3 client deployments using Erlang OTP ssl, especially those with {session_tickets, auto} configured, should assess exposure and prioritize verification and potential updates.

Why it matters

Defenders should prioritize verifying exposure in TLS 1.3 client deployments using Erlang OTP ssl, especially those with {session_tickets, auto} configured, and assess the need for updates to OTP 27.3.4.19, 28.5.0.8, or 29.1.2 due to potential denial of service and ssl supervisor restarts.

• Denial of service of the ssl application on the client node
• Potential repeated crashes exceeding the restart intensity of the ssl supervisors
• Take down ssl for all connections on the node

Technical summary

The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions, accepting a 0-length early_data extension. This causes the node-global tls_client_ticket_store to crash on the next automatic resumption. The crash can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node. Repeated crashes can lead to denial of service of the ssl application on the client node and potential ssl supervisor restarts.

Defensive priority

Defenders should prioritize verifying exposure in TLS 1.3 client deployments using Erlang OTP ssl, especially those with {session_tickets, auto} configured, and assess the need for updates to OTP 27.3.4.19, 28.5.0.8, or 29.1.2.

Recommended defensive actions

• Verify and apply OTP updates to 27.3.4.19, 28.5.0.8, or 29.1.2
• Assess exposure in TLS 1.3 client deployments using Erlang OTP ssl
• Configure {session_tickets, auto} with caution
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, limited information is available on potential exploits or victim organizations. Defenders should verify the affected scope, severity, and vendor guidance through official advisories or CVE records. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.