{"id":"CVE-2024-53846","aliases":["AZL-54051","DEBIAN-CVE-2024-53846","EUVD-2024-52172","GHSA-qw6r-qh9v-638v","UBUNTU-CVE-2024-53846","USN-7961-1"],"status":"published","title":"ssl fails to validate incorrect extened key usage","description":"OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00263,"percentile":0.18298,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2024-12-05T17:02:59Z","modified":"2026-11-02T12:02:57Z","fixes":[{"ecosystem":"Azure Linux:3","package":"erlang","fixed_in":["26.2.5.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"erlang","fixed_in":["1:27.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"erlang","fixed_in":["1:27.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"erlang","fixed_in":["1:25.3.2.8+dfsg-1ubuntu4.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.3.2.8+dfsg-1ubuntu4.6"}]}],"versions":["1:25.2.3+dfsg-1","1:25.3.2.8+dfsg-1","1:25.3.2.8+dfsg-1ubuntu1","1:25.3.2.8+dfsg-1ubuntu3","1:25.3.2.8+dfsg-1ubuntu4","1:25.3.2.8+dfsg-1ubuntu4.1","1:25.3.2.8+dfsg-1ubuntu4.2","1:25.3.2.8+dfsg-1ubuntu4.3","1:25.3.2.8+dfsg-1ubuntu4.4","1:25.3.2.8+dfsg-1ubuntu4.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.3.2.8+dfsg-1ubuntu4.6"}]}],"versions":["1:25.2.3+dfsg-1","1:25.3.2.8+dfsg-1","1:25.3.2.8+dfsg-1ubuntu1","1:25.3.2.8+dfsg-1ubuntu3","1:25.3.2.8+dfsg-1ubuntu4","1:25.3.2.8+dfsg-1ubuntu4.1","1:25.3.2.8+dfsg-1ubuntu4.2","1:25.3.2.8+dfsg-1ubuntu4.3","1:25.3.2.8+dfsg-1ubuntu4.4","1:25.3.2.8+dfsg-1ubuntu4.5"]}],"products":[{"vendor":"erlang","product":"otp"}],"references":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-qw6r-qh9v-638v","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53846","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53846.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-53846","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-53846","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53846","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7961-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-53846","title":"ssl fails to validate incorrect extened key usage","description":"OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).","status":"published","published":"2024-12-05T17:02:59.37Z","modified":"2024-12-06T16:26:57.528Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:34:17.523201Z"}],"euvd":[{"id":"EUVD-2024-52172","description":"OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).","status":"published","published":"2024-12-05T17:02:59Z","modified":"2024-12-06T16:26:57Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:39.149757Z"}],"nvd":[{"id":"CVE-2024-53846","description":"OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).","status":"published","published":"2024-12-05T17:15:14.477Z","modified":"2026-06-17T08:09:24.577Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:10:39.434419Z"}],"osv":[{"id":"CVE-2024-53846","title":"ssl fails to validate incorrect extened key usage","description":"OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).","status":"published","published":"2024-12-05T17:02:59.37Z","modified":"2026-10-28T02:30:23.824176188Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"DEBIAN-CVE-2024-53846","description":"OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).","status":"published","published":"2024-12-05T17:15:14.477Z","modified":"2026-11-02T12:02:57.029220401Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"UBUNTU-CVE-2024-53846","description":"OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).","status":"published","published":"2024-12-05T17:15:00Z","modified":"2026-04-22T15:20:43.957134Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"AZL-54051","title":"CVE-2024-53846 affecting package erlang for versions less than 26.2.5.6-1","description":"OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).","status":"published","published":"2024-12-05T17:15:14Z","modified":"2026-04-21T04:55:50.575035Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"USN-7961-1","title":"erlang vulnerability","description":"It was discovered that Erlang incorrectly validated peer certificates\nwhen incorrect extended key usage was presented. A remote attacker could\npossibly use this issue to bypass SSL key usage restrictions.","status":"published","published":"2026-01-14T13:37:18Z","modified":"2026-04-22T11:06:09.023997Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}