EXECUTIVE SUMMARY:
CVE-2026-49457 with a CVSS score of 9.1 is a flaw affecting the erlang/quic framework. This vulnerability stems from a broken TLS verification process where the QUIC client fails to authenticate the server during the TLS 1.3 handshake, specifically by not checking the CertificateVerify signature, validating the certificate chain, or comparing the hostname against the certificate. An attacker positioned as a man-in-the-middle on the network path can exploit this weakness by presenting any arbitrary certificate to impersonate a legitimate server, thereby compromising the confidentiality and integrity of the connection. Successful exploitation allows an adversary to intercept sensitive data or modify communications unnoticed, posing severe risks to application security and user trust, particularly for environments relying on HTTP/3. Note that this issue is conditional and does not affect handshakes authenticated via a Pre-Shared Key during session resumption, as no certificate exchange occurs in those scenarios.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-49457 with a CVSS score of 9.1 is a flaw affecting the erlang/quic framework. This vulnerability stems from a broken TLS verification process where the QUIC client fails to authenticate the server during the TLS 1.3 handshake, specifically by not checking the CertificateVerify signature, validating the certificate chain, or comparing the hostname against the certificate. An attacker positioned as a man-in-the-middle on the network path can exploit this weakness by presenting any arbitrary certificate to impersonate a legitimate server, thereby compromising the confidentiality and integrity of the connection. Successful exploitation allows an adversary to intercept sensitive data or modify communications unnoticed, posing severe risks to application security and user trust, particularly for environments relying on HTTP/3. Note that this issue is conditional and does not affect handshakes authenticated via a Pre-Shared Key during session resumption, as no certificate exchange occurs in those scenarios.[emaillocker id="1283"]
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-2r8v-p65x-3663