SUSE CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-77703

Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle AiTM. This issue affects Liman Render Engine: from 1.0 before 1.2-75...

CVE-2026-77703 SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine

Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle AiTM. This issue affects Liman Render Engine: from 1.0 before 1.2-75...

PT-2026-97835

Name of the Vulnerable Software and Affected Versions Liman Render Engine versions 1.0 through 1.2-74 Description A key exchange without entity authentication issue allows an Adversary in the Middle AiTM attack. This occurs when the system fails to properly verify the identity of the communicatin...

Linux Distros Unpatched Vulnerability : CVE-2026-89422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended...

AZL-103428 CVE-2026-89422 affecting package erlang 26.2.5.21-6

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

DEBIAN-CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

UBUNTU-CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

EEF-CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

Summary Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake witho...

CVE-2026-89422

Erlang/OTP ssl module contains a TLS 1.3 server authentication bypass : a pre_shared_key extension in the ServerHello that the client never offered sets resumption = true without verification, causing the client to skip all certificate-validation states (path validation, verify_fun, hostname chec...

CVE-2026-89422 TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

PT-2026-96690

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 22.2 through 27.3.4.17 Erlang/OTP versions 28.0 through 28.5.0.6 Erlang/OTP versions 29.0 through 29.1.0 ssl versions 9.5 through 11.2.12.12 ssl versions 11.6.0 through 11.6.0.5 ssl versions 11.7.0 through 11.7.6 Descriptio...

CVE-2026-89422

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to disabled SSH host key verification in the EMR SSH helper commands. An attacker can intercept SSH sessions and file transfers by performing a man-in-the-middle attack between the client a...

CVE-2026-18654

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2745)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the...

Key Exchange without Entity Authentication

Overview apache-airflow-providers-git is a Provider package apache-airflow-providers-git for Apache Airflow Affected versions of this package are vulnerable to Key Exchange without Entity Authentication via the GitHook SSH transport options in airflow/providers/git/hooks/git.py. An attacker who c...