CVE-2026-105236: OTP 18.0 to before *; status changes: 27.3.4.19 — unaffected, 28.5.0.8 — unaffected, 29.1.2 — unaffected, 7.0 to…

Affected technology

OTP · 18.0 to before *; status changes: 27.3.4.19 — unaffected, 28.5.0.8 — unaffected, 29.1.2 — unaffected
Erlang

OTP · 7.0 to before *; status changes: 11.2.12.14 — unaffected, 11.6.0.7 — unaffected, 11.7.8 — unaffected
Erlang

OTP · 4fe38c4b8b2c8024afb60990e598ff823743fd54 to before *; status changes: 0c20f3683b3c81fd30b46047195be9b3d2c69d76 — unaffected, 4d76adbf39d547a931048544df09c3c087e56618 — unaffected, 10ee925d0fee8413f1170cc21bfcf123c8d22454 — unaffected
Erlang

Component: ssl_gen_statem, ssl_config, ssl_session, ssl_handshake
Function: ssl_gen_statem:handle_sni_extension/2, ssl_gen_statem:handle_sni_hostname/2, ssl_gen_statem:update_ssl_options_from_sni/2, ssl_gen_statem:fallback_options/2, ssl_config:update_options/3, ssl_config:opt_reuse_sessions/3, ssl_session:server_select_session/5, ssl_session:is_resumable/4, ssl_session:reusable_options/2, ssl_handshake:select_session/8
File: lib/ssl/src/ssl_gen_statem.erl, lib/ssl/src/ssl_config.erl, lib/ssl/src/ssl_session.erl, lib/ssl/src/ssl_handshake.erl, src/ssl_gen_statem.erl, src/ssl_config.erl, src/ssl_session.erl, src/ssl_handshake.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.