CVE-2024-53846: Erlang OTP

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).

Affected products

• Erlang OTP: from 25.3.2.8, up to and including 25.3.2.16; from 26.2, up to and including 26.2.5.6; from 27.0, up to and including 27.1.3; up to and including 25.3.2.8

Published 2024-12-05. Last modified 2026-06-17.