The Erlang/OTP ssl application does not properly validate that the pre-shared key (PSK) identity list and binder list in a TLS 1.3 ClientHello message have equal length before passing them to the session ticket handler. Specifically, in tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreSharedKeys record with mismatched identities and binders is forwarded to tls_server_session_ticket:use/4, which crashes the session ticket handler process. An unauthenticated remote attacker can exploit this by sending a single crafted ClientHello to a TLS 1.3 server with session tickets enabled, causing persistent disruption of session ticket handling until the ssl application is restarted. This affects OTP versions from 22.2 before OTP 29.0.3, OTP 28.5.0.3, and OTP 27.3.4.14, corresponding to ssl versions 9.5 before 11.7.3, 11.6.0.3, and 11.2.12.10. TLS 1.2 is not impacted.

An unauthenticated remote attacker can cause a denial of service by crashing the session ticket handler process on a TLS 1.3 server with session tickets enabled. This disruption makes TLS 1.3 unusable on the affected listener until the ssl application is restarted. The vulnerability does not affect TLS 1.2 connections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, affected Erlang/OTP installations should consider restarting the ssl application if session ticket handling is disrupted. Monitoring for unusual TLS 1.3 handshake failures may help detect exploitation attempts. Avoid relying on TLS 1.3 session tickets if possible until patched.