Vulnpedia
← Search CVEs

CVE-2026-105236

MEDIUM 6.3

Published 2026-10-14 · Last modified 2026-10-16

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI names from one listen socket through sni_fun or sni_hosts keeps one pre-TLS 1.3 session cache per listener and does not bind a cached session to the SNI name or client trust policy that established it. When an SNI option set switches to verify_peer without naming reuse_sessions, ssl_config:update_options/3 inherits the base listener's reuse_sessions value of true, so the default that disables reuse for client-authenticating servers does not apply. On an abbreviated handshake ssl_session:is_resumable/4 checks only that the cached session uses one of the current server certificates and carries some peer certificate, and never revalidates that certificate against the CA selected for the requested name. The names must share a server certificate, which is common with wildcard or multi-SAN certificates. TLS 1.3 does not use this cache and is not affected. This issue affects OTP from OTP 18.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 7.0 before 11.2.12.14, 11.6.0.7, and 11.7.8.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 29th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

6.3CVSS 4.0 · MEDIUM

  • ConfidentialityLow
  • IntegrityLow
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Erlang

Products Otp

Weakness (CWE)

  • CWE-295: Improper Certificate Validation

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 118 vendor product statements; 86 omitted. Read the full vendor advisory.

  • erlang27-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-asn1-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-common_test-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-compiler-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-crypto-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-dialyzer-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-diameter-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-edoc-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-eldap-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-erts-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-et-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-eunit-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-examples-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-gdb-tools-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-inets-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-jinterface-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-kernel-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-mnesia-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-observer-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-odbc-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-os_mon-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-public_key-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-reltool-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-runtime_tools-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-snmp-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-ssh-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-ssl-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-stdlib-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-tftp-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-tools-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-wx-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00
  • erlang27-xmerl-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener: - Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache. - Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts. - Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache. In addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw.
    Red Hat · CVE-2026-105236 · Updated 2026-10-20T04:11:25+00:00

All CVSS metrics

  • MEDIUM 6.3 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  • MEDIUM 6.3 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS