AZL-103428 CVE-2026-89422 affecting package erlang 26.2.5.21-6

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

UBUNTU-CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-89422

Erlang/OTP ssl module contains a TLS 1.3 server authentication bypass : a pre_shared_key extension in the ServerHello that the client never offered sets resumption = true without verification, causing the client to skip all certificate-validation states (path validation, verify_fun, hostname chec...

PT-2026-96690

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 22.2 through 27.3.4.17 Erlang/OTP versions 28.0 through 28.5.0.6 Erlang/OTP versions 29.0 through 29.1.0 ssl versions 9.5 through 11.2.12.12 ssl versions 11.6.0 through 11.6.0.5 ssl versions 11.7.0 through 11.7.6 Descriptio...

CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

VulnCheck KEV: CVE-2026-50752

A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication. Successful exploitation could all...

Astra Linux – Vulnerability in golang-go.crypto

SSH servers that implement file transfer protocols are vulnerable to a denial of service attack from clients that complete the key exchange slowly, or not at all. This results in pending data being read into memory but never being transmitted...

Astra Linux – Vulnerability in gnutls28

A flaw was discovered in libgnutls. A remote attacker could trigger a short heap overread by sending an extremely short premaster secret during an RSA key exchange to a server that uses an RSA key backed by a PKCS11 token. This memory corruption vulnerability could lead to information disclosure...

Astra Linux – Vulnerability in python-cryptography

A flaw was discovered in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which could result in the exposure of confidential or sensitive data...

Astra Linux – Vulnerability in gnutls28

A vulnerability was identified: the response times for malformed ciphertexts in RSA-PSK ClientKeyExchange differ from those of ciphertexts with correct PKCS1 v1.5 padding...

Astra Linux – Vulnerability in gnutls28

A timing side-channel vulnerability in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be used to recover the key encrypted in the RSA ciphertext across a network, in a Bleichenbacher-style attack. To successfully decrypt the data, the attacker would...

Astra Linux – Vulnerability in libssh2

In libssh2 before version 1.9.0, the kexmethoddiffiehellmangroupexchangesha256keyexchange function in kex.c contains an integer overflow that could lead to an out-of-bounds read when packets are read from the server. A remote attacker who compromises an SSH server may be able to disclose sensitiv...

CVE-2026-18654

A flaw was found in AWS CLI. This vulnerability, located in the Elastic MapReduce EMR Secure Shell SSH helper commands, involves a lack of entity authentication during key exchange. A remote attacker, positioned between the client and the EMR cluster, could exploit this to intercept SSH sessions...

Linux Distros Unpatched Vulnerability : CVE-2026-18654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow...

OESA-2026-3419 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers from the client...

CVE-2026-73430

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...