{"id":"EEF-CVE-2026-94200","summary":"TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl","details":"## Summary\n\nImproper Validation of Consistency within Input vulnerability in Erlang OTP ssl (`tls_handshake_1_3`, `ssl_handshake` and `tls_client_ticket_store` modules) allows a malicious TLS 1.3 server to cause a denial of service of the `ssl` application on the client node.\n\nThe TLS 1.3 client decodes the extensions of a `NewSessionTicket` message as if they came from `EncryptedExtensions`. It therefore accepts a 0-length `early_data` extension, a form that is only valid in `ClientHello` and `EncryptedExtensions`. With `{session_tickets, auto}`, the client stores the ticket in the node-global `tls_client_ticket_store`. On the next automatic resumption, `tls_handshake_1_3:get_max_early_data/1` crashes the store with a `case_clause`. Repeated crashes can exceed the restart intensity of the `ssl` supervisors, which use the `rest_for_one` strategy, and take down `ssl` for all connections on the node.\n\nThis issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8.\n\n## Details\n\n**1. Decoding.** `tls_handshake_1_3:decode_handshake/2` decodes the extensions of a `NewSessionTicket` with the message type `encrypted_extensions`. `ssl_handshake:decode_extensions/4` does not check the message type for most extensions. A 0-length `early_data` extension therefore decodes to `#early_data_indication{}`, the `ClientHello` and `EncryptedExtensions` form, and not to `#early_data_indication_nst{}`, the 4-byte `max_early_data_size` form that RFC 8446 requires in a `NewSessionTicket`.\n\n**2. Storage.** In `auto` mode the client sends the ticket to the node-global `tls_client_ticket_store` gen_server, which keeps it for later resumption.\n\n**3. Crash.** When a later connection resumes automatically, the store calls `tls_handshake_1_3:get_max_early_data/1` on the stored extensions, from `maybe_use_ticket` and `get_tickets`. That function only handles `undefined` and `#early_data_indication_nst{}`, so the store process crashes with a `case_clause`.\n\n**4. Escalation.** The store is a `permanent` child of `ssl_admin_sup`. Each restart of the store also restarts the children after it, because the supervisor uses `rest_for_one`. A server that keeps sending the malformed ticket makes the crashes repeat. When the crashes exceed the supervisor restart intensity, the failure goes up through `ssl_sup` and stops the `ssl` application for the whole node.\n\nThe fix makes `ssl_handshake:decode_extensions/4` accept each extension form only in the handshake messages where it is permitted, and decodes `NewSessionTicket` extensions with the message type `new_session_ticket`.\n\n## Impact\n\nA malicious TLS 1.3 server can crash the client node's session ticket store, and by repeating the attack it can stop the `ssl` application for all TLS connections on that node. Only clients that use `{session_tickets, auto}` are affected.\n\n## Workarounds\n\nDo not set `{session_tickets, auto}` on TLS 1.3 clients. Use `manual` ticket handling, or keep the default value `disabled`.\n\n## Configurations\n\nOnly TLS 1.3 clients that set the `ssl` option `{session_tickets, auto}` are affected. The default value of `session_tickets` is `disabled`, and clients that use `manual` ticket handling do not store tickets in the node-global ticket store. The client must also connect to a server that the attacker controls, or that the attacker can impersonate.","aliases":["CVE-2026-94200","GHSA-m5mh-q53w-67jq"],"modified":"2026-10-14T17:11:11.025308832Z","published":"2026-10-14T16:55:23.328Z","database_specific":{"capec_ids":["CAPEC-153"],"cpe_ids":["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-1288"]},"references":[{"type":"ADVISORY","url":"https://github.com/erlang/otp/security/advisories/GHSA-m5mh-q53w-67jq"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-94200.html"},{"type":"WEB","url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"type":"WEB","url":"https://github.com/erlang/otp/commit/0abe6f66db0d295cd06b0efab3bdb3caa2803930"},{"type":"FIX","url":"https://github.com/erlang/otp/commit/66febc190e6dc42a5c4aedbfe250bf9a2edc2d5e"},{"type":"FIX","url":"https://github.com/erlang/otp/commit/00a333bcf2800b69f540369b54167e897dae7219"},{"type":"FIX","url":"https://github.com/erlang/otp/commit/cd0334854bf3ef56dc16f9fb728efe88fb05c4ac"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/erlang/otp","events":[{"introduced":"0abe6f66db0d295cd06b0efab3bdb3caa2803930"},{"fixed":"66febc190e6dc42a5c4aedbfe250bf9a2edc2d5e"},{"fixed":"00a333bcf2800b69f540369b54167e897dae7219"},{"fixed":"cd0334854bf3ef56dc16f9fb728efe88fb05c4ac"}]}],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-94200.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"credits":[{"name":"Lukas Backström / Erlang Solutions","type":"REPORTER"},{"name":"Ingela Anderton Andin","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"}]}