{"id":"CVE-2022-37026","aliases":["ALPINE-CVE-2022-37026","DEBIAN-CVE-2022-37026","DLA-3491-1","EUVD-2022-39680","GHSA-f399-ff4w-62fm","MGASA-2022-0450","OESA-2023-1912","OESA-2023-1941","OESA-2023-1942","RHSA-2022:8857","SUSE-SU-2022:4215-1","SUSE-SU-2022:4222-1","SUSE-SU-2023:3401-1","SUSE-SU-2023:3409-1","SUSE-SU-2023:4109-1","UBUNTU-CVE-2022-37026","USN-6059-1","openSUSE-SU-2024:12416-1","openSUSE-SU-2025:15740-1"],"status":"published","title":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client...","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01487,"percentile":0.74261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2022-09-21T00:00:00Z","modified":"2026-11-03T08:03:53Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"erlang","fixed_in":["24.3.4.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"erlang","fixed_in":["25.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"erlang","fixed_in":["25.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"erlang","fixed_in":["25.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"erlang","fixed_in":["25.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"erlang","fixed_in":["25.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"erlang26","fixed_in":["25.0.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"erlang","fixed_in":["1:24.3.4.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"erlang","fixed_in":["1:24.3.4.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"erlang","fixed_in":["1:24.3.4.5+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"erlang","fixed_in":["1:22.2.7+dfsg-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"erlang","fixed_in":["23.2.1-3.2.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"erlang","fixed_in":["23.3.4.9-3.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"erlang","fixed_in":["23.3.4.9-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"erlang","fixed_in":["23.3.4.9-3.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-asn1","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-asn1-debuginfo","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-compiler","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-crypto","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-crypto-debuginfo","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-debuginfo","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-debugsource","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-eldap","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-erl_interface-debuginfo","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-erts","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-erts-debuginfo","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-hipe","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-inets","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-kernel","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-mnesia","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-odbc-debuginfo","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-os_mon","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-os_mon-debuginfo","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-parsetools","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-public_key","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-runtime_tools","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-runtime_tools-debuginfo","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-sasl","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-snmp","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-ssl","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-stdlib","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-syntax_tools","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-tools","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-tools-debuginfo","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-xmerl","fixed_in":["0:23.3.4.18-1.el8ost"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"erlang","fixed_in":["22.3-150300.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"erlang","fixed_in":["22.3-150300.3.3.1","22.3-150300.3.8.1","23.3.4.19-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"erlang","fixed_in":["22.3-150300.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"erlang","fixed_in":["22.3-150300.3.3.1","22.3-150300.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"erlang","fixed_in":["22.2.7-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"erlang","fixed_in":["22.2.7-150200.3.3.1","22.2.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"erlang","fixed_in":["22.2.7-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"erlang","fixed_in":["22.2.7-150200.3.3.1","22.2.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"erlang","fixed_in":["22.2.7-150200.3.3.1","22.2.7-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"erlang","fixed_in":["22.2.7-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"erlang","fixed_in":["22.2.7-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"erlang","fixed_in":["22.2.7-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"erlang","fixed_in":["22.2.7-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"erlang","fixed_in":["22.3-150300.3.8.1","23.3.4.19-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"erlang","fixed_in":["22.3-150300.3.8.1","23.3.4.19-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"erlang","fixed_in":["22.3-150300.3.8.1","23.3.4.19-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"erlang","fixed_in":["22.3-150300.3.8.1","23.3.4.19-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"erlang","fixed_in":["22.3-150300.3.8.1","23.3.4.19-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"erlang","fixed_in":["22.3-150300.3.8.1","23.3.4.19-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"erlang","fixed_in":["22.3-150300.3.8.1","23.3.4.19-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"erlang","fixed_in":["22.3-150300.3.8.1","23.3.4.19-150300.3.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"erlang","fixed_in":["22.3-150300.3.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"erlang","fixed_in":["1:22.2.7+dfsg-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"erlang","fixed_in":["1:24.2.1+dfsg-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"erlang","fixed_in":["25.1.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3.4.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"erlang26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3.4.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3.4.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.3.4.5+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1+deb10u1"}]}],"versions":["1:21.2.6+dfsg-1","1:21.2.6+dfsg-1+hurd.1","1:22.0+dfsg-1","1:22.0.1+dfsg-1","1:22.0.3+dfsg-1","1:22.0.4+dfsg-1","1:22.0.5+dfsg-1","1:22.0.5+dfsg-2","1:22.0.7+dfsg-1","1:22.0.7+dfsg-2","1:22.0.7+dfsg-3","1:22.0~rc1+dfsg-1","1:22.0~rc2+dfsg-1","1:22.0~rc3+dfsg-1","1:22.1+dfsg-1","1:22.1.1+dfsg-1","1:22.1.1+dfsg-2","1:22.1.1+dfsg-3","1:22.1.5+dfsg-1","1:22.1.6+dfsg-1","1:22.1.7+dfsg-1","1:22.1.8+dfsg-1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:8","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.1-3.2.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.9-3.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.9-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.9-3.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-asn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-asn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-crypto-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-eldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-erl_interface-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-erts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-erts-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-hipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-inets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-mnesia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-os_mon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-os_mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-parsetools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-public_key","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-runtime_tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-runtime_tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-syntax_tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"erlang-xmerl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.3.4.18-1.el8ost"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.7-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.19-150300.3.11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1","1:16.b.3-dfsg-1ubuntu2.2","1:16.b.3-dfsg-1ubuntu2.2+esm1","1:16.b.3-dfsg-1ubuntu2.2+esm2","1:16.b.3-dfsg-1ubuntu2.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3","1:18.3-dfsg-1ubuntu3.1","1:18.3-dfsg-1ubuntu3.1+esm1","1:18.3-dfsg-1ubuntu3.1+esm2","1:18.3-dfsg-1ubuntu3.1+esm3","1:18.3-dfsg-1ubuntu3.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:20.0.4+dfsg-1ubuntu1","1:20.1.2+dfsg-1ubuntu1","1:20.1.3+dfsg-1ubuntu1","1:20.1.4+dfsg-1ubuntu1","1:20.1.5+dfsg-1ubuntu1","1:20.1.6+dfsg-1ubuntu1","1:20.1.7+dfsg-1ubuntu1","1:20.2.1+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu2","1:20.2.2+dfsg-1ubuntu2+esm1","1:20.2.2+dfsg-1ubuntu2+esm2","1:20.2.2+dfsg-1ubuntu2+esm3","1:20.2.2+dfsg-1ubuntu2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1ubuntu0.2"}]}],"versions":["1:22.0.7+dfsg-1build1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.2.1+dfsg-1ubuntu0.1"}]}],"versions":["1:23.2.6+dfsg-1build1","1:24.1.1+dfsg-1","1:24.1.4+dfsg-1","1:24.1.5+dfsg-1","1:24.1.5+dfsg-1ubuntu1","1:24.2+dfsg-1","1:24.2.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1ubuntu0.2"}]}],"versions":["1:22.0.7+dfsg-1build1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.2.1+dfsg-1ubuntu0.1"}]}],"versions":["1:23.2.6+dfsg-1build1","1:24.1.1+dfsg-1","1:24.1.4+dfsg-1","1:24.1.5+dfsg-1","1:24.1.5+dfsg-1ubuntu1","1:24.2+dfsg-1","1:24.2.1+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"erlang27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1.3-1.1"}]}],"bundled":5}],"products":[{"vendor":"erlang","product":"erlang\\/otp"}],"references":[{"url":"https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15","tags":["x_transferred","Patch","Third Party Advisory","web","report"]},{"url":"https://erlangforums.com/c/erlang-news-announcements/91","tags":["x_transferred","Release Notes","Vendor Advisory","web","report"]},{"url":"https://erlangforums.com/t/otp-25-1-released/1854","tags":["x_transferred","Release Notes","Vendor Advisory","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00012.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37026","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f399-ff4w-62fm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-37026","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37026.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-37026","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0450.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31190","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-November/013107.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FKGB2TBMVRY5L4FUEC3LM2R2WTCDC2Y7/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1912","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1941","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1942","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8857","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2141802","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8857.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-37026","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-37026","tags":["advisory","report"]},{"url":"https://github.com/erlang/otp/releases/tag/OTP-25.1","tags":["article"]},{"url":"https://www.erlang.org/patches/otp-25.1","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224215-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205318","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37026","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224222-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233401-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207113","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233409-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234109-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-37026","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6059-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48041","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-37026","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.","status":"published","published":"2022-09-21T00:00:00Z","modified":"2025-05-27T18:19:43.782Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-39680","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.","status":"published","published":"2022-09-21T00:00:00Z","modified":"2025-05-27T18:19:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:37.949923Z"}],"ghsa":[{"id":"GHSA-f399-ff4w-62fm","title":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client...","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.","status":"published","published":"2022-09-22T00:00:30Z","modified":"2023-07-11T18:31:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:54:42.596364Z"}],"nvd":[{"id":"CVE-2022-37026","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.","status":"published","published":"2022-09-21T14:15:11.223Z","modified":"2026-06-17T04:54:29.667Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"ALPINE-CVE-2022-37026","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.","status":"published","published":"2022-09-21T14:15:11.223Z","modified":"2026-11-03T07:31:27.490740502Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"CVE-2022-37026","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.","status":"published","published":"2022-09-21T00:00:00Z","modified":"2026-10-28T02:30:47.287320926Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DEBIAN-CVE-2022-37026","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.","status":"published","published":"2022-09-21T14:15:11.223Z","modified":"2026-11-03T08:03:53.958393501Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"OESA-2023-1912","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.(CVE-2022-37026)","status":"published","published":"2023-12-15T11:06:21Z","modified":"2026-08-18T01:18:05.495328094Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1941","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.(CVE-2022-37026)","status":"published","published":"2023-12-22T11:06:23Z","modified":"2026-08-18T01:18:07.633347048Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1942","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.(CVE-2022-37026)","status":"published","published":"2023-12-22T11:06:23Z","modified":"2026-08-18T01:18:06.755074524Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2022:8857","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (erlang) security update","status":"published","published":"2024-09-16T09:52:29Z","modified":"2025-11-22T12:42:20Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2022-37026","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.","status":"published","published":"2022-09-21T14:15:00Z","modified":"2026-10-08T12:49:20.584918705Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"DLA-3491-1","title":"erlang - security update","status":"published","published":"2023-07-11T00:00:00Z","modified":"2026-03-09T01:22:43.999729Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2022-0450","title":"Updated erlang packages fix security vulnerability","description":"In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before\n25.0.2, there is a Client Authentication Bypass in certain\nclient-certification situations for SSL, TLS, and DTLS. (CVE-2022-37026)\n","status":"published","published":"2022-12-06T23:32:48Z","modified":"2026-04-16T04:42:13.687196665Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12416-1","title":"erlang-25.1.1-1.1 on GA media","description":"These are all security issues fixed in the erlang-25.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:47:33.545481Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2025:15740-1","title":"erlang27-27.1.3-1.1 on GA media","description":"These are all security issues fixed in the erlang27-27.1.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-18T00:00:00Z","modified":"2026-03-23T04:54:09.333733Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2022:4215-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\n- CVE-2022-37026: fixed a client authorization bypass vulnerability for SSL,\n  TLS, and DTLS in Erlang/OTP. [bsc#1205318]\n","status":"published","published":"2022-11-24T15:48:30Z","modified":"2026-02-04T03:50:04.137053Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4222-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\n- CVE-2022-37026: fixed a client authorization bypass vulnerability for SSL,\n  TLS, and DTLS in Erlang/OTP. [bsc#1205318]\n","status":"published","published":"2022-11-25T12:43:03Z","modified":"2026-02-04T04:39:04.482723Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2023:3401-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\n- Replaced the CVE-2022-37026 patch with the one released by the upstream to fix a regression in the previous one. (bsc#1205318)\n","status":"published","published":"2023-08-23T17:06:37Z","modified":"2025-05-02T04:33:29.186979Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3409-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\n- Replaced the CVE-2022-37026 patch with the one released by the upstream to fix a regression in the previous one. (bsc#1205318)\n","status":"published","published":"2023-08-23T18:18:04Z","modified":"2026-02-04T03:22:15.382868Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:4109-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\n- Updated to version 23.3.4.19 (jsc#PED-6209):\n  - CVE-2022-37026: Complete a previous insufficient fix for an\n    authentication bypass (bsc#1205318).\n","status":"published","published":"2023-10-18T10:18:52Z","modified":"2026-02-04T03:22:17.465603Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6059-1","title":"erlang vulnerability","description":"It was discovered that Erlang did not properly implement TLS client\ncertificate validation during the TLS handshake. A remote attacker could\nuse this issue to bypass client authentication.\n","status":"published","published":"2023-05-08T08:40:04Z","modified":"2026-04-27T16:39:29.88524Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}