Vulnerability · CVE-2026-54891
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned att
Published Jul 2, 2026 · catalog updated Oct 26, 2026 · Improper Enforcement of Message
Last checked Oct 29, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-54891. EPSS is 0.14%. Act only if a listed version of Improper Enforcement of Message is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Improper Enforcement of Message).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Low3.7
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.14%
- Remediation
- Advisory link
- Affected products
- Debian:12 erlang · Debian:13 erlang · Debian:14 erlang
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive in pre-handshake states when the TLS endpoint acts as a server, but does not apply the same check when the endpoint acts as a client. A network-positioned attacker can send plaintext APPLICATION_DATA records to the client during the handshake. The records are buffered and, once the handshake completes successfully, delivered to the application as if they were authenticated post-handshake data. The attacker cannot observe the client's response or steer the connection, so the impact is limited to blind injection of unauthenticated bytes. The injection window is wider for TLS versions prior to TLS 1.3 than for TLS 1.3. This vulnerability is associated with program file lib/ssl/src/tls_gen_connection.erl. TLS 1.3 is affected starting with OTP 22.0, when TLS 1.3 support was added. This issue affects OTP from OTP 17.0 before OTP 27.3.4.14, from OTP 28.0 before OTP 28.5.0.3, and from OTP 29.0 before OTP 29.0.3, corresponding to ssl from 5.3.4 before 11.2.12.10, from 11.3 before 11.6.0.3, and from 11.7 before 11.7.3. Whether OTP before OTP 17.0, corresponding to ssl before 5.3.4, is affected is unknown.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Debian:12 erlang1:25.2.3+dfsg-1, 1:25.2.3+dfsg-1+deb12u1, 1:25.2.3+dfsg-1+deb12u2
- Debian:13 erlang0 → 1:27.3.4.1+dfsg-1+deb13u3
- Debian:14 erlang0 → 1:29.0.3+dfsg-1
How to fix CVE-2026-54891
Upgrade
CVE-2026-54891 lists a fix boundary at 1:27.3.4.1+dfsg-1+deb13u3. Compare the installed build with that boundary before you change production.
Version check
Fixed in 1:27.3.4.1+dfsg-1+deb13u3 · 4 other ranges on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-54891. EPSS is 0.14%. Act only if a listed version of Improper Enforcement of Message is installed.
Which versions are affected?
Compare what you have installed with 1:25.2.3+dfsg-1, 1:25.2.3+dfsg-1+deb12u1, 1:25.2.3+dfsg-1+deb12u2, 0 → 1:27.3.4.1+dfsg-1+deb13u3, 0 → 1:29.0.3+dfsg-1. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
No weakness class is stored. EPSS 0.14%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jul 2, 2026 · Trivy Vulnerability DB
Detected
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive i
Oct 26, 2026 · Trivy Vulnerability DB
Fix available
erlang fixed in 1:27.3.4.1+dfsg-1+deb13u3; erlang fixed in 1:29.0.3+dfsg-1
Oct 26, 2026 · Trivy Vulnerability DB
Fix available
erlang fixed in 1:27.3.4.1+dfsg-1+deb13u3
Oct 26, 2026 · Trivy Vulnerability DB
Fix available
erlang fixed in 1:29.0.3+dfsg-1
Oct 26, 2026 · Trivy Vulnerability DB
Updated
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive i
Sources
- CVE.orgVulnerability recordCVE-2026-54891
Official CVE identifier
cve.org - Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-54891
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authentica
osv.dev
References
Freshness
Last verified in this catalog Oct 29, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- CVE.orgOct 26, 2026
- Trivy Vulnerability DBOct 26, 2026