FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Erlang/OTP -- (D)TLS-1.2 server certificate verification bypass

Affected packages
erlang < 28.5.0.4,4
erlang-runtime27 < 27.3.4.15
erlang-runtime28 < 28.5.0.4
erlang-runtime29 < 29.0.4

Details

VuXML ID 445c61c0-89e1-11f1-b35c-4c526214c986
Discovery 2026-07-27
Entry 2026-07-27

https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882 reports:

The OTP TLS/DTLS client (pre TLS-1.3) does not verify that the cipher suite selected by the server in ServerHello is one of those offered in ClientHello. A man-in-the-middle attacker can select an anonymous cipher suite such as ECDH_anon that was never offered by the client. Since anonymous suites do not require a server certificate, this completely bypasses the client's verify_peer setting, giving the attacker a fully established connection without possessing any trusted certificate, and thus complete read and modify access to the transmitted data. TLS-1.3 is not affected.

References

CVE Name CVE-2026-55953
URL https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882