Erlang OTP CVE-2026-94200

Exploitation requires the victim to be a TLS 1.3 CLIENT configured with {session_tickets, auto} (automatic ticket storage and resumption) and to connect to an attacker-controlled or MITM TLS 1.3 server; the crash manifests on the NEXT automatic resumption after a malicious NewSessionTicket with a 0-length early_data extension is stored. Limiting factors: the attacker cannot reach the victim directly - the client must initiate the outbound connection, session_tickets must be set to auto (not the implicit default for all deployments), and TLS 1.3 must be in use. These conditions correspond to the AT:P (Attack Requirements: Present) metric and mean default or non-resuming TLS-client configurations are not affected. Affected: OTP 23.3 up to the fixed releases (ssl 10.3 onward).

This is a genuine availability risk but narrower than its 8.2 score suggests at first glance. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) correctly captures the shape: network-reachable, no privileges, no user interaction, but with AT:P (Attack Requirements: Present) reflecting that exploitation is NOT unconditional - it depends on the client being configured with {session_tickets, auto} and performing automatic resumption, and on the victim initiating a connection to an attacker-controlled TLS 1.3 server. Impact is confined to availability (VA:H / A:H); there is no confidentiality or integrity loss. The SSVC-style reading is: technical impact is total for the ssl application (it can take down TLS for ALL connections on the node via the rest_for_one supervisor cascade), but exploitation is server-triggered rather than attacker-reachable against an exposed listener, which limits automatability and mass scanning. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or at-scale exploitation; this reads as a credible, patch-worthy DoS rather than an emergency. Signals are internally consistent - there is no network-vs-local or auth contradiction to flag.

An attacker stands up (or hijacks via MITM/DNS) a malicious TLS 1.3 server and induces a vulnerable Erlang/OTP client - one configured with {session_tickets, auto} - to connect to it. The server returns a NewSessionTicket carrying a 0-length early_data extension; the client stores the malformed ticket in the node-global tls_client_ticket_store, and the next automatic resumption triggers a case_clause crash in tls_handshake_1_3:get_max_early_data/1. Repeating this exhausts the ssl supervisors' restart intensity and takes down the ssl application node-wide; no public exploit code was identified at time of analysis.