Erlang/OTP -- multiple vulnerabilities in ssl, ssh and asn1

2026-09-25 · CVE-2026-65634, CVE-2026-68956, CVE-2026-89422 · VuXML entry

The Erlang/OTP project reports: OTP 29.1.1, 28.5.0.7 and 27.3.4.18 fix the following issues: CVE-2026-89422: TLS 1.3 client skips server authentication on unsolicited PSK. A pre_shared_key extension in the ServerHello that the client never offered causes the client to complete the handshake without validating the server's certificate. CVE-2026-68956: SSH session channel exhaustion. The max_channels daemon option …

Affected versions

• erlang < 28.5.0.7,4
• erlang-runtime27 < 27.3.4.18
• erlang-runtime28 < 28.5.0.7
• erlang-runtime29 < 29.1.1

By system

3 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.