CVE-2026-105236: 
Erlang OTP vulnerability analysis and mitigation

CVE-2026-105236 is an Improper Certificate Validation vulnerability (CWE-295) in the ssl application of Erlang/OTP that allows a TLS 1.2 client authenticated to one SNI virtual host to resume its session at a second, higher-trust SNI virtual host on the same listener without re-validating its certificate against the second host's CA. The vulnerability affects Erlang/OTP from version 18.0 up to (but not including) OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl library versions 7.0 through 11.2.12.14, 11.6.0.7, and 11.7.8. It was disclosed on October 14, 2026, and was responsibly reported by Yonghwa Lee and Xint by Theori. It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory).

The root cause (CWE-295) lies in how Erlang/OTP's TLS 1.2 session cache operates: a single pre-TLS 1.3 session cache is maintained per listen socket, and cached sessions are not bound to the SNI name or client trust policy that established them. When an SNI option set uses verify_peer without explicitly setting reuse_sessions, ssl_config:update_options/3 inherits the base listener's reuse_sessions: true value, bypassing the default that would disable reuse for client-authenticating servers. During an abbreviated handshake, ssl_session:is_resumable/4 only checks that the cached session uses one of the current server certificates and carries some peer certificate — it never revalidates that certificate against the CA configured for the requested SNI name. Exploitation requires that at least two SNI names share the same server certificate (common with wildcard or multi-SAN certificates) but use distinct client CAs, TLS 1.2 is negotiated, and the attacker holds a valid client certificate for the lower-trust SNI. TLS 1.3 uses a different ticket/PSK path and is not affected (GitHub Advisory, Fix Commit).

A client with a legitimate certificate trusted only by a lower-trust SNI virtual host can authenticate to a higher-trust SNI virtual host on the same listener by resuming a previously established TLS 1.2 session, bypassing the per-host client certificate authority validation. This results in unauthorized access to resources or services protected by the higher-trust virtual host, with low confidentiality and low integrity impact on the vulnerable system. Availability is not directly affected, and there is no impact on subsequent systems. The attack is limited to deployments where multiple SNI names share a server certificate and use distinct client CAs, which is a common configuration with wildcard or multi-SAN certificates (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires specific preconditions: the attacker must already possess a valid client certificate for a lower-trust SNI name on the same listener, TLS 1.2 must be negotiated, and the server must use a shared certificate across SNI names with distinct client CAs. No threat actor attribution has been identified (GitHub Advisory).

1. Reconnaissance: Identify an Erlang/OTP TLS server (OTP 18.0–27.3.4.18 / 28.x before 28.5.0.8 / 29.x before 29.1.2) that serves multiple SNI virtual hosts on a single listener using sni_fun or sni_hosts, with TLS 1.2 enabled.
2. Obtain lower-trust certificate: Acquire or already possess a valid client certificate trusted by the lower-trust SNI virtual host (e.g., low.example.com) but not by the higher-trust host (e.g., high.example.com).
3. Establish initial session: Connect to the server using TLS 1.2 with the SNI set to the lower-trust name (e.g., low.example.com), completing a full handshake and saving the resulting session ID (e.g., using OpenSSL's -sess_out flag).
4. Attempt session resumption at higher-trust host: Initiate a new TLS 1.2 connection to the same listener with the SNI set to the higher-trust name (e.g., high.example.com), presenting the saved session ID for resumption (e.g., using OpenSSL's -sess_in flag) along with the lower-trust client certificate.
5. Bypass CA validation: On vulnerable versions, the server's ssl_session:is_resumable/4 accepts the abbreviated handshake without revalidating the client certificate against the higher-trust CA, granting the attacker access to the higher-trust virtual host (GitHub Advisory, Fix Commit).

• Network: TLS 1.2 abbreviated handshakes (session resumption) to a server listener where the ClientHello SNI name differs from the SNI name that originally established the cached session; repeated session resumption attempts across different SNI names from the same client IP.
• Logs: Server-side TLS logs showing a session ID being reused across different SNI hostnames in rapid succession; absence of a full handshake (no Certificate or CertificateVerify messages) for connections to higher-trust SNI names from clients that should require re-authentication.
• Application: Unexpected access to resources or APIs protected by a higher-trust SNI virtual host from a client identity (certificate subject/issuer) that is only authorized for a lower-trust SNI name.

Erlang/OTP has released patched versions: OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2 (corresponding ssl library versions 11.2.12.14, 11.6.0.7, and 11.7.8). Upgrading to one of these versions is the recommended remediation. For deployments that cannot upgrade immediately, the following workarounds are available: (1) serve distinct SNI trust domains on separate listen sockets so each has its own session cache; (2) explicitly set {reuse_sessions, false} in each SNI service's option set or in the default server configuration; or (3) enforce TLS 1.3 exclusively, as it does not use the affected session-ID cache (GitHub Advisory).

The vulnerability was responsibly disclosed to the Erlang/OTP project by Yonghwa Lee and Xint by Theori (underdog@theori.io), and the advisory was published by Erlang/OTP maintainer IngelaAndin on October 14, 2026. No significant broader media coverage or notable community commentary beyond the official advisory and standard CVE tracking feeds has been identified at this time (GitHub Advisory).