CVE-2024-53846

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
erlang	otp	>= 25.3.2.8, <= 25.3.2.16; >= 26.2, <= 26.2.5.6; >= 27.0, <= 27.1.3
erlang	otp	<= 25.3.2.8

References

https://github.com/erlang/otp/security/advisories/GHSA-qw6r-qh9v-638v

Timeline

Published: Dec 5, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-538475.1The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pastin CVE-2024-538487.1check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote sc CVE-2024-538494.8editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected version CVE-2024-53854.1A vulnerability, which was classified as problematic, has been found in oretnom23 Online Car Wash Booking System 1.0. This issue affects som CVE-2024-538508.2The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.CVE-2024-538516.5Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline oneboxes for URLs was CVE-2024-538554.3Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis o CVE-2024-538567.5rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. T CVE-2024-538577.5rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp CVE-2024-538586.5The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentica CVE-2024-538597.5go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been ident CVE-2024-53868.8In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role