CVE-2022-37026: Erlang Erlang/otp

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.

Affected products

• Erlang Erlang/otp: before 23.3.4.15 (fixed in 23.3.4.15); from 24.0, before 24.3.4.2 (fixed in 24.3.4.2); from 25.0, before 25.0.2 (fixed in 25.0.2)

Published 2022-09-21. Last modified 2026-06-17.