Erlang/OTP -- multiple vulnerabilities in ssl, inets, public_key and snmp

2026-10-16 · CVE-2026-42789, CVE-2026-48856, CVE-2026-70405, CVE-2026-94200, CVE-2026-105236 · VuXML entry

The Erlang/OTP project reports: OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix the following issues, three of which complete earlier incomplete fixes: CVE-2026-105236: (D)TLS-1.2 session resumption could cross SNI virtual-host boundaries. An SNI-aware server resumed a cached session even when the resumption request's server_name differed from the one that established it, so a client could bypass the client-authentication …

Affected versions

• erlang < 28.5.0.8,4
• erlang-runtime27 < 27.3.4.19
• erlang-runtime28 < 28.5.0.8
• erlang-runtime29 < 29.1.2

By system

3 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.