CVE-2026-89422 – Erlang

This update closes a critical authentication bypass in the Erlang/OTP ssl application. CVE-2026-89422 has a CVSS score of 9.3, Critical severity. A malicious peer that answers a TLS 1.3 client connection can impersonate the intended server. It does this by sending a pre-shared key extension the client never offered. The client then completes the handshake without validating the server's certificate. This skips certificate path validation, hostname verification, CRL checking and OCSP stapling, so the connection succeeds against a peer with no certificate, no private key and no prior session.

The default client configuration is affected. Clients restricted to TLS 1.2 are not affected. The flaw affects OTP 22.2 and later. The fixed releases are OTP 27.3.4.18, OTP 28.5.0.7 and OTP 29.1.1, which correspond to ssl 11.2.12.13, 11.6.0.6 and 11.7.7. Any Erlang or Elixir service that makes outbound TLS connections is exposed to interception and data theft until it is patched.