CRITICAL🇵🇱 Wersja polska

CVE-2022-37026

CVSS 9.8v3.1pub. 2022-09-21upd. 2025-05-27

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Erlang Erlang\/otp

    APP
    Erlang
    < 23.3.4.1524.0 – 24.3.4.2 (excl.)25.0 – 25.0.2 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓same product

Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)

CVE-2026-55953CRITICAL9.1same product

The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the...

CVE-2016-10253CRITICAL9.8PL ✓same product

Heap overflow w generowaniu wyrażeń regularnych w Erlang/OTP 18.x

CVE-2026-54890HIGH8.2PL ✓same product

Integer Underflow w dekoderze ETF Erlang/OTP — DoS przez abort węzła

CVE-2026-58227HIGH8.7PL ✓same product

Erlang/OTP TLS/DTLS: nieskończona rekurencja przy cross-signed certyfikatach (DoS)