{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-0CAC6ABE",
  "slug": "cve-2026-89422-erlang-otp-tls13-unsolicited-psk-auth-bypass",
  "title": "Erlang TLS 1.3 client can trust a server with no certificate",
  "aliases": [
    "CVE-2026-89422",
    "CVE-2026-68956",
    "CVE-2026-65634",
    "GHSA-rgxr-4g4w-j875",
    "OTP TLS unsolicited PSK"
  ],
  "summary": "CVE-2026-89422 is a Critical (CVSS 4.0 9.3) TLS 1.3 client authentication bypass in Erlang/OTP ssl: an unsolicited ServerHello pre_shared_key extension causes ssl:connect to return {ok, Socket} without validating the peer certificate. Same-day siblings CVE-2026-68956 (SSH idle session-channel memory DoS) and CVE-2026-65634 (ASN.1 OID decode CPU DoS during TLS cert parse) share the OTP 29.1.1 / 28.5.0.7 / 27.3.4.18 patch train.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "Confirm the exact OTP/ssl/ssh/asn1 patch level for your packaged release (Elixir, RabbitMQ, etc.) against the live ERLEF/GHSA sources. TLS 1.2-only clients are out of scope for 89422.",
  "firstObservedAt": "2026-09-22T00:00:00.000Z",
  "lastObservedAt": "2026-09-22T13:05:20.971Z",
  "publishedAt": "2026-09-22T13:11:48.957Z",
  "reviewedAt": "2026-09-22T13:11:40.348Z",
  "expiresAt": "2026-09-22T13:05:20.971Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "erlef-89422",
      "label": "ERLEF CNA CVE-2026-89422",
      "url": "https://cna.erlef.org/cves/CVE-2026-89422.html",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-22T00:00:00.000Z"
    },
    {
      "id": "ghsa-89422",
      "label": "GHSA-rgxr-4g4w-j875",
      "url": "https://github.com/erlang/otp/security/advisories/GHSA-rgxr-4g4w-j875",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-22T00:00:00.000Z"
    },
    {
      "id": "erlef-68956",
      "label": "ERLEF CNA CVE-2026-68956",
      "url": "https://cna.erlef.org/cves/CVE-2026-68956.html",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-22T00:00:00.000Z"
    },
    {
      "id": "erlef-65634",
      "label": "ERLEF CNA CVE-2026-65634",
      "url": "https://cna.erlef.org/cves/CVE-2026-65634.html",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-22T00:00:00.000Z"
    },
    {
      "id": "otp-release",
      "label": "OTP 29.1.1 release",
      "url": "https://github.com/erlang/otp/releases/tag/OTP-29.1.1",
      "sourceType": "other_primary",
      "observedAt": "2026-09-22T13:05:20.971Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL Guard operator write-up",
      "url": "https://hol.org/blog/cve-2026-89422-erlang-otp-tls13-unsolicited-psk-auth-bypass",
      "sourceType": "other_primary",
      "observedAt": "2026-09-22T13:05:20.971Z"
    },
    {
      "id": "guard-pack",
      "label": "HOL Guard evidence pack CVE-2026-89422",
      "url": "https://hol.org/guard/security/cves/CVE-2026-89422",
      "sourceType": "other_primary",
      "observedAt": "2026-09-22T13:05:20.971Z"
    }
  ],
  "artifacts": [
    {
      "id": "otp",
      "artifactClass": "package",
      "ecosystem": "erlang",
      "name": "erlang/otp",
      "version": ">=22.2 <27.3.4.18 || >=28.0 <28.5.0.7 || >=29.0 <29.1.1",
      "defanged": false
    },
    {
      "id": "ssl",
      "artifactClass": "package",
      "ecosystem": "erlang",
      "name": "ssl",
      "version": ">=9.5 <11.2.12.13 || >=11.3 <11.6.0.6 || >=11.7 <11.7.7",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "disclosure",
      "occurredAt": "2026-09-22T00:00:00.000Z",
      "eventType": "disclosure",
      "summary": "ERLEF/OTP disclosed CVE-2026-89422 Critical TLS 1.3 client auth bypass plus siblings CVE-2026-68956 and CVE-2026-65634.",
      "sourceIds": [
        "erlef-89422",
        "ghsa-89422",
        "erlef-68956",
        "erlef-65634"
      ]
    },
    {
      "id": "vendor-patch",
      "occurredAt": "2026-09-22T00:00:00.000Z",
      "eventType": "vendor_action",
      "summary": "Patched OTP releases published: 29.1.1, 28.5.0.7, 27.3.4.18.",
      "sourceIds": [
        "otp-release",
        "ghsa-89422"
      ]
    },
    {
      "id": "hol-publish",
      "occurredAt": "2026-09-22T13:05:20.971Z",
      "eventType": "other",
      "summary": "HOL Guard published operator blog coverage for the OTP TLS cluster.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "TLS clients restricted to TLS 1.2 are not affected by CVE-2026-89422.",
    "CVE-2026-68956 requires an authenticated SSH session; max_channels is not a workaround.",
    "CVE-2026-65634 is CPU DoS during OID/cert parse, not certificate forgery.",
    "No configuration both keeps TLS 1.3 and mitigates CVE-2026-89422.",
    "Does not invent CVSS or fixed versions beyond ERLEF/GHSA citations."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-89422-erlang-otp-tls13-unsolicited-psk-auth-bypass/corrections"
}