AIKIDO-2026-600274
erlang is vulnerable to Improper Validation of Specified Quantity in Input
82
High Risk
This Affects:
erlangTL;DR
Affected versions of Erlang/OTP are vulnerable to a denial-of-service (DoS) issue where a malformed TLS 1.3 ClientHello can crash the session ticket handler process. An unauthenticated attacker can disrupt TLS 1.3 by preventing session ticket issuance, causing new TLS 1.3 connections to fail until the affected listeners or the ssl application are restarted. TLS 1.2 is not affected.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
erlang is vulnerable to Improper Validation of Specified Quantity in Input in versions 22.2.0 - 27.3.4.13, 28.0.0 - 28.5.0.2 and 29.0.0 - 29.0.2.
How to fix this
Upgrade the erlang library to the patch version.
Links
GitHub Release
Fix Commits
github.com/erlang/otp/commit/2c3e599797644310e5d4aa39c7193420e59dadffgithub.com/erlang/otp/commit/9b5437c72fa3403a75c1aba28e5c532bc191c662github.com/erlang/otp/commit/e77823e6d980b2ec0b4fe4ea3f2d098ca239e3ce
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant