The Erlang/OTP SSL TLS 1.2 and earlier DTLS client fails to verify that the server-selected cipher suite in ServerHello was among those offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates protocol version and downgrade sentinel but does not check cipher suite membership before passing it to ssl_handshake:handle_server_hello_extensions/9. This allows an on-path attacker to select anonymous key exchange suites (e.g., TLS_DH_anon_*, TLS_ECDH_anon_*) not offered by the client. Anonymous suites do not require server certificates, bypassing peer verification and certificate checks. Consequently, the attacker can complete the handshake with ephemeral parameters, intercept and modify all subsequent traffic. The TLS 1.3 client path is not affected as it performs this check per RFC 8446. Affected OTP versions include R13B03 before 27.3.4.15, 28.0 before 28.5.0.4, and 29.0 before 29.0.4, corresponding to ssl versions 3.10.7 before 11.2.12.11, 11.3 before 11.6.0.4, and 11.7 before 11.7.4. It is unknown if versions before R13B03 are affected.

An on-path attacker can exploit this vulnerability to force the client to use an anonymous cipher suite that bypasses certificate validation, allowing the attacker to intercept, read, and modify all encrypted traffic between the client and server. This compromises confidentiality and integrity of communications without triggering certificate verification errors. The vulnerability affects TLS 1.2 and earlier DTLS clients in Erlang/OTP and does not impact TLS 1.3 clients.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects specific Erlang/OTP versions prior to OTP 27.3.4.15, 28.5.0.4, and 29.0.4. Users should monitor Erlang's official advisories for patches or updates addressing this issue. Until a patch is applied, avoid using vulnerable OTP versions in environments where on-path attackers are a concern.