CVE-2026-54891: Erlang/OTP TLS Client Message Integrity Vulnerability

Technical summary

CVE-2026-54891 is an improper message integrity enforcement vulnerability in the tls_gen_connection module of Erlang/OTP's ssl library. The vulnerability stems from asymmetric validation logic in tls_gen_connection:handle_protocol_record/3. When the TLS endpoint operates as a server, the function correctly rejects APPLICATION_DATA records received during the pre-handshake phase. However, when the same endpoint acts as a client, this protective check is not applied. An unauthenticated network attacker can exploit this gap by transmitting plaintext APPLICATION_DATA frames to the client during the TLS handshake. These records are buffered by the ssl module and, upon successful handshake completion, are passed up to the application layer as authenticated data. Because the attacker has no ability to receive or observe responses from the victim application, exploitation results only in one-way injection of raw bytes. The vulnerability affects OTP releases starting from R13B03 through multiple current branches: OTP 27.x (before 27.3.4.14), OTP 28.x (before 28.5.0.3), and OTP 29.x (before 29.0.3). TLS 1.3 support became available in OTP 22.0, marking the earliest point at which TLS 1.3 connections could be affected. Pre-TLS 1.3 versions in those OTP branches face a wider attack window.

Business impact

Organizations deploying Erlang/OTP as a TLS client face risk of data tampering if network infrastructure is untrusted or adversaries operate as man-in-the-middle proxies. A successful exploit allows an attacker to inject arbitrary bytes into the application's data stream without detection or acknowledgment, potentially corrupting protocol state, triggering logic flaws, or introducing malicious payloads (e.g., crafted messages to trigger application-level vulnerabilities). The impact is typically blind and delayed—manifesting only after the legitimate handshake completes. For applications handling sensitive client-server interactions (distributed systems, messaging, payment, or control protocols built on Erlang/OTP), this represents a subtle but real avenue for injection attacks. Conversely, applications using Erlang/OTP in server mode are not affected by this specific flaw. The low CVSS score reflects the attacker's inability to exfiltrate data or cause denial of service, but organizations in high-assurance environments should not discount the integrity compromise.

Affected systems

Erlang/OTP versions from R13B03 through the present are in scope. Specifically: OTP 27.x up to and including 27.3.4.13, OTP 28.0 through 28.5.0.2, and OTP 29.0 through 29.0.2 are vulnerable. Corresponding ssl module versions affected are 3.10.7 through 11.2.12.9, 11.3 through 11.6.0.2, and 11.7 through 11.7.2. Whether OTP releases prior to R13B03 (ssl before 3.10.7) are vulnerable is not confirmed. Applications that embed Erlang/OTP and use the ssl library for outbound TLS client connections—such as microservices, distributed databases, messaging brokers, and protocol implementations written in Erlang—require assessment and patching.

Exploitability

Exploitation requires network-layer positioning to intercept and inject frames into the TLS handshake. The attacker must be able to send crafted TLS records to the target client before the handshake concludes, typically requiring compromise of network infrastructure, DNS hijacking, BGP hijacking, or placement on a shared network segment. Once positioned, the attack is straightforward: send plaintext APPLICATION_DATA frames that will be buffered and later delivered as authenticated. Because the attacker cannot observe responses, attacks must be speculative or based on knowledge of the target protocol. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) correctly reflects the network requirement (AV:N), the high complexity due to the requirement for positioning and lack of feedback (AC:H), and the integrity impact without confidentiality or availability loss (I:L). The vulnerability is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no known public exploitation in the wild at this time.

Remediation

Upgrade Erlang/OTP to a patched release immediately. The fix corrects the asymmetry in validation by applying the pre-handshake APPLICATION_DATA check consistently to both client and server modes. Users must verify the specific patch versions for their branch: consult the official Erlang/OTP release notes and advisories to confirm the exact version that resolves CVE-2026-54891 in your deployment. After patching, restart affected applications to load the updated ssl module.

Patch guidance

Apply the following patched versions according to your OTP branch: OTP 27.3.4.14 or later for the 27.x series, OTP 28.5.0.3 or later for the 28.x series, and OTP 29.0.3 or later for the 29.x series. These versions include the corrected tls_gen_connection module that enforces APPLICATION_DATA rejection symmetrically during the pre-handshake phase for both client and server endpoints. Test the patched version in a staging environment first to ensure compatibility with your application and any custom ssl configurations. Verify that all dependent applications are rebuilt or relinked against the patched OTP library if they statically link the ssl module.

Detection guidance

Detection is challenging because the injected plaintext is queued and delivered as part of normal post-handshake traffic, making it difficult to distinguish from legitimate data at the network level. Monitor TLS handshake logs and application-level protocol violations for anomalous message sequencing or unexpected payload structures that arrive immediately after a handshake completes. Intrusion detection systems positioned on the network edge may observe unusual plaintext frames during active TLS handshakes, but false positives are likely. The most reliable detection approach is code review and testing of Erlang/OTP applications that act as TLS clients; confirm that your version is vulnerable and prioritize patching over detection.

Why prioritize this

Despite the low CVSS score, this vulnerability warrants timely patching because it enables silent, blind injection of data into authenticated channels—a subtle and difficult-to-detect integrity compromise. Organizations relying on Erlang/OTP for distributed systems, microservices, or protocols where message integrity is assumed should treat this as a medium-priority remediation. Patch within 60–90 days if your deployment includes Erlang/OTP clients in untrusted network environments (cloud, internet-facing services). For internal-only or air-gapped Erlang/OTP deployments, priority can be deferred slightly, but should not be neglected indefinitely.

Risk score, explained

The CVSS 3.1 base score of 3.7 (LOW) accurately reflects that the vulnerability requires network positioning (AV:N, AC:H), allows only blind injection of integrity (I:L), and provides no confidentiality or availability impact. The high complexity factor (AC:H) recognizes that the attacker must be positioned at the right time during handshake and cannot reliably confirm success. However, the context matters: in environments where TLS channels are assumed to be fully authenticated end-to-end, even a low-confidence injection channel represents a meaningful threat. Security teams should consider environmental and business context when deciding remediation urgency.

Frequently asked questions