CVE-2026-94200: 
Erlang OTP vulnerability analysis and mitigation

CVE-2026-94200 is a denial-of-service vulnerability in Erlang OTP's TLS 1.3 client implementation, specifically in the tls_handshake_1_3, ssl_handshake, and tls_client_ticket_store modules. A malicious or man-in-the-middle TLS 1.3 server can send a NewSessionTicket message containing a 0-length early_data extension — a form only valid in ClientHello and EncryptedExtensions — causing the node-global tls_client_ticket_store to crash on the next automatic session resumption attempt. Repeated crashes can exceed the restart intensity of the ssl supervisors (which use the rest_for_one strategy), taking down the ssl application for all connections on the affected Erlang node. The vulnerability affects Erlang OTP from version 23.3 before 27.3.4.19, 28.5.0.8, and 29.1.2 (corresponding to ssl library versions 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8). It carries a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-1288 (Improper Validation of Consistency within Input). The vulnerable code in tls_handshake_1_3.erl decodes NewSessionTicket message extensions using the encrypted_extensions message type context rather than the correct new_session_ticket context, causing it to accept a 0-length early_data extension that is structurally invalid for that message type. When the client is configured with {session_tickets, auto}, the poisoned ticket is stored in the node-global tls_client_ticket_store; on the next automatic resumption attempt, tls_handshake_1_3:get_max_early_data/1 encounters the malformed extension and crashes the store process with a case_clause error. The fix, applied across multiple commits, changes the decode_handshake call for NEW_SESSION_TICKET to pass new_session_ticket as the message type, and adds strict message-type guards throughout ssl_handshake.erl to prevent cross-context extension acceptance (GitHub Commit 66febc1, GitHub Commit 00a333b).

Successful exploitation results in a complete denial of service of the Erlang ssl application on the affected client node, disabling all TLS connections — not just the connection to the malicious server. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. Because the tls_client_ticket_store is node-global and the ssl supervisors use the rest_for_one restart strategy, a single poisoned ticket can cascade into a node-wide ssl outage affecting all concurrent and subsequent TLS connections on that node (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or intercept a TLS 1.3 server that the vulnerable client connects to (a man-in-the-middle or rogue server scenario), and the client must have {session_tickets, auto} enabled — which is not the default configuration (GitHub Advisory).

1. Identify target: Locate an Erlang node running OTP 23.3 through 27.3.4.18, 28.x before 28.5.0.8, or 29.x before 29.1.2, with TLS 1.3 clients configured with {session_tickets, auto}.
2. Position as malicious server: Set up a rogue TLS 1.3 server that the target client will connect to, or perform a man-in-the-middle attack on an existing TLS 1.3 connection.
3. Complete initial TLS 1.3 handshake: Allow the client to complete a normal TLS 1.3 handshake to establish trust and reach the post-handshake phase.
4. Send poisoned NewSessionTicket: Transmit a NewSessionTicket message containing an early_data extension with a 0-length value (the #early_data_indication{} form, valid only in ClientHello/EncryptedExtensions), rather than the correct #early_data_indication_nst{indication = MaxSize} form required for NewSessionTicket.
5. Trigger crash on resumption: Wait for the client to attempt automatic session resumption using the stored poisoned ticket. The call to tls_handshake_1_3:get_max_early_data/1 will crash the tls_client_ticket_store process with a case_clause error.
6. Exhaust supervisor restart intensity: Repeat steps 3–5 (or rely on the client's automatic reconnection behavior) to trigger repeated crashes, exceeding the rest_for_one supervisor restart intensity and bringing down the ssl application for all connections on the node (GitHub Advisory, GitHub Commit 66febc1).

• Logs: Erlang crash reports in the node's error logger showing case_clause errors originating from tls_handshake_1_3:get_max_early_data/1 or tls_client_ticket_store; repeated supervisor restart messages for the ssl application's supervision tree.
• Logs: Erlang system log entries indicating the ssl application has been terminated due to exceeded restart intensity under the rest_for_one strategy.
• Process: Unexpected termination of the tls_client_ticket_store gen_server process; all new TLS connection attempts on the node failing with ssl application errors after repeated crashes.
• Network: Unusual TLS 1.3 NewSessionTicket messages from a server containing a 0-length early_data extension (detectable via TLS traffic inspection tools such as Wireshark filtering on tls.handshake.type == 4 with anomalous extension data).

Upgrade Erlang OTP to one of the patched versions: OTP 27.3.4.19, OTP 28.5.0.8, or OTP 29.1.2 (corresponding to ssl library versions 11.2.12.14, 11.6.0.7, and 11.7.8 respectively). As an immediate workaround without upgrading, avoid using {session_tickets, auto} in TLS client configurations — switching to {session_tickets, manual} or disabling session tickets entirely ({session_tickets, disabled}, which is the default) prevents the vulnerable code path from being triggered. Additionally, restrict outbound TLS 1.3 connections to trusted servers only to reduce exposure to rogue server attacks (GitHub Advisory).

The vulnerability was reported by researcher garazdawi and remediated by IngelaAndin (remediation developer) and u3s (remediation reviewer) from the Erlang/OTP team, with the advisory published on October 14, 2026 (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the official advisory and automated CVE tracking feeds has been identified at this time.