{"schema":"vulnpedia.research/1","cve":"CVE-2026-105236","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-2g23-cgjh-34gq","tags":["related","vendor-advisory","vendor-reference"],"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","origins":[{"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","url":"https://github.com/erlang/otp/security/advisories/GHSA-2g23-cgjh-34gq"},{"source":"nvd","sourceId":"CVE-2026-105236","modified":"2026-10-16T21:17:15.680","url":"https://github.com/erlang/otp/security/advisories/GHSA-2g23-cgjh-34gq"},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://github.com/erlang/otp/security/advisories/GHSA-2g23-cgjh-34gq"}]},{"url":"https://cna.erlef.org/cves/CVE-2026-105236.html","tags":["related","vendor-reference"],"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","origins":[{"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","url":"https://cna.erlef.org/cves/CVE-2026-105236.html"},{"source":"nvd","sourceId":"CVE-2026-105236","modified":"2026-10-16T21:17:15.680","url":"https://cna.erlef.org/cves/CVE-2026-105236.html"},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://cna.erlef.org/cves/CVE-2026-105236.html"}]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-105236","tags":["related","vendor-reference"],"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","origins":[{"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","url":"https://osv.dev/vulnerability/EEF-CVE-2026-105236"},{"source":"nvd","sourceId":"CVE-2026-105236","modified":"2026-10-16T21:17:15.680","url":"https://osv.dev/vulnerability/EEF-CVE-2026-105236"},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://osv.dev/vulnerability/EEF-CVE-2026-105236"}]},{"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions","tags":["x_version-scheme","vendor-reference"],"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","origins":[{"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"source":"nvd","sourceId":"CVE-2026-105236","modified":"2026-10-16T21:17:15.680","url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"}]},{"url":"https://github.com/erlang/otp/commit/4fe38c4b8b2c8024afb60990e598ff823743fd54","tags":["related","vendor-reference"],"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","origins":[{"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","url":"https://github.com/erlang/otp/commit/4fe38c4b8b2c8024afb60990e598ff823743fd54"},{"source":"nvd","sourceId":"CVE-2026-105236","modified":"2026-10-16T21:17:15.680","url":"https://github.com/erlang/otp/commit/4fe38c4b8b2c8024afb60990e598ff823743fd54"},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://github.com/erlang/otp/commit/4fe38c4b8b2c8024afb60990e598ff823743fd54"}]},{"url":"https://github.com/erlang/otp/commit/0c20f3683b3c81fd30b46047195be9b3d2c69d76","tags":["patch","vendor-reference"],"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","origins":[{"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","url":"https://github.com/erlang/otp/commit/0c20f3683b3c81fd30b46047195be9b3d2c69d76"},{"source":"nvd","sourceId":"CVE-2026-105236","modified":"2026-10-16T21:17:15.680","url":"https://github.com/erlang/otp/commit/0c20f3683b3c81fd30b46047195be9b3d2c69d76"},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://github.com/erlang/otp/commit/0c20f3683b3c81fd30b46047195be9b3d2c69d76"}]},{"url":"https://github.com/erlang/otp/commit/4d76adbf39d547a931048544df09c3c087e56618","tags":["patch","vendor-reference"],"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","origins":[{"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","url":"https://github.com/erlang/otp/commit/4d76adbf39d547a931048544df09c3c087e56618"},{"source":"nvd","sourceId":"CVE-2026-105236","modified":"2026-10-16T21:17:15.680","url":"https://github.com/erlang/otp/commit/4d76adbf39d547a931048544df09c3c087e56618"},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://github.com/erlang/otp/commit/4d76adbf39d547a931048544df09c3c087e56618"}]},{"url":"https://github.com/erlang/otp/commit/10ee925d0fee8413f1170cc21bfcf123c8d22454","tags":["patch","vendor-reference"],"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","origins":[{"source":"mitre","sourceId":"EEF","modified":"2026-10-14T16:55:51.495Z","url":"https://github.com/erlang/otp/commit/10ee925d0fee8413f1170cc21bfcf123c8d22454"},{"source":"nvd","sourceId":"CVE-2026-105236","modified":"2026-10-16T21:17:15.680","url":"https://github.com/erlang/otp/commit/10ee925d0fee8413f1170cc21bfcf123c8d22454"},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://github.com/erlang/otp/commit/10ee925d0fee8413f1170cc21bfcf123c8d22454"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105236","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-105236"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552595","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552595"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105236","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-105236"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105236","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105236"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:83217","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://access.redhat.com/errata/RHSA-2026:83217"}]},{"source":"euvd","sourceId":"EUVD-2026-101387","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101387","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-101387","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101387"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-asn1-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-asn1-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-asn1@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-common_test-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-common_test-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-common_test@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-compiler-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-compiler-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-compiler@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-crypto-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-crypto-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-crypto@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-dialyzer-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-dialyzer-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-dialyzer@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-diameter-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-diameter-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-diameter@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-edoc-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-edoc-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-edoc@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-eldap-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-eldap-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-eldap@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-erts-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-erts-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-erts@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-et-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-et-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-et@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-eunit-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-eunit-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-eunit@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-examples-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-examples-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-examples@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-gdb-tools-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-gdb-tools-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-gdb-tools@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-inets-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-inets-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-inets@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-jinterface-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-jinterface-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-jinterface@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-kernel-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-kernel-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-kernel@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-mnesia-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-mnesia-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-mnesia@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-observer-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-observer-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-observer@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-odbc-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-odbc-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-odbc@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-os_mon-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-os_mon-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-os_mon@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-public_key-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-public_key-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-public_key@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-reltool-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-reltool-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-reltool@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-runtime_tools-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-runtime_tools-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-runtime_tools@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-snmp-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-snmp-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-snmp@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-ssh-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-ssh-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-ssh@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-ssl-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-ssl-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-ssl@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-stdlib-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-stdlib-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-stdlib@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-tftp-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-tftp-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-tftp@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-tools-0:27.3.4.19-0.1.hum1@aarch64","product":"erlang27-tools-0:27.3.4.19-0.1.hum1@aarch64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-tools@27.3.4.19-0.1.hum1?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-wx-0:27.3.4.19-0.1.hum1@s390x","product":"erlang27-wx-0:27.3.4.19-0.1.hum1@s390x as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-wx@27.3.4.19-0.1.hum1?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]},{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json","productId":"Red Hat Hardened Images:erlang27-xmerl-0:27.3.4.19-0.1.hum1@x86_64","product":"erlang27-xmerl-0:27.3.4.19-0.1.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:83217"},{"category":"workaround","details":"Workarounds are available for Erlang/OTP TLS servers that serve multiple SNI virtual hosts from a single listener:\n- Serve SNI names that require distinct client CA trust domains on separate listen sockets, so each listener keeps its own TLS session cache.\n- Explicitly set {reuse_sessions, false} in each SNI service's option set, or in the default server configuration, to disable TLS 1.2 session resumption for client-authenticating virtual hosts.\n- Use TLS 1.3, which is not affected because it does not use the pre-TLS 1.3 session-ID cache.\nIn addition, update to the fixed erlang27 package provided through the Red Hat Hardened Images errata for this flaw."}],"purl":"pkg:rpm/redhat/erlang27-xmerl@27.3.4.19-0.1.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-105236","modified":"2026-10-20T04:11:25+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105236.json"}]}],"vendorCoverage":{"total":118,"shown":32,"omitted":86,"source":"redhat"}}