The Erlang/OTP project reports:
OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix the following
issues, three of which complete earlier incomplete
fixes:
- CVE-2026-105236: (D)TLS-1.2 session resumption could
cross SNI virtual-host boundaries. An SNI-aware server
resumed a cached session even when the resumption
request's server_name differed from the one that
established it, so a client could bypass the
client-authentication boundary of a second virtual
service and skip the certificate exchange.
- CVE-2026-94200: a malicious or man-in-the-middle
TLS-1.3 server could poison a client's ticket store with
a NewSessionTicket carrying a zero-length early_data
extension. A client using automatic session-ticket
management stored the ticket and crashed on a later
resumption, taking down the node-global client ticket
store.
- CVE-2026-42789: the earlier fix for certificate chain
forgery via non-CA intermediates in public_key left the
X.509 version 1 and version 2 path uncovered. Such
certificates carry no basicConstraints and are now
rejected in issuer position.
- CVE-2026-48856: the earlier fix for credential leaks
on cross-origin httpc redirects did not clear the
userinfo component of the request URI, so credentials
given as http://user:password@host/path were still sent
to the redirect target.
- CVE-2026-70405: the earlier byte-length bounds on
snmp varbind values did not cover the v3 header fields,
the USM security parameters or the PDU integer fields,
which could still be decoded into arbitrarily large
integers.