CVE-2026-54891: erlang/otp from 17.0 (inclusive), before 27.3.4.14 (exclusive), from 28.0 (inclusive), before 28.5.0.3 (exclusive)…

Affected technology

erlang/otp · from 17.0 (inclusive), before 27.3.4.14 (exclusive)
erlang

erlang/otp · from 28.0 (inclusive), before 28.5.0.3 (exclusive)
erlang

erlang/otp · from 29.0 (inclusive), before 29.0.3 (exclusive)
erlang

erlang/ssl · from 5.3.4 (inclusive), before 11.2.12.10 (exclusive)
erlang

erlang/ssl · from 11.3 (inclusive), before 11.6.0.3 (exclusive)
erlang

erlang/ssl · from 11.7 (inclusive), before 11.7.3 (exclusive)
erlang

OTP · 17.0 to before 27.3.4.14, 28.0 to before 28.5.0.3, 29.0 to before 29.0.3
Erlang

OTP · 5.3.4 to before 11.2.12.10, 11.3 to before 11.6.0.3, 11.7 to before 11.7.3
Erlang

OTP · 84adefa331c4159d432d22840663c38f155cd4c1 to before 07d2d0e93f6aaf7652a81e8df075fc1728da5e96
Erlang

Component: tls_gen_connection
Function: tls_gen_connection:handle_protocol_record/3
File: lib/ssl/src/tls_gen_connection.erl, src/tls_gen_connection.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A network-positioned attacker can inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. Source advisory’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and availability impact as none; integrity impact as low.