CVE-2026-49457
Received Received - Intake

Missing Certificate Validation in erlang_quic QUIC Client

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description
erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate, so `verify` was effectively a no-op on the client. A man-in-the-middle on the network path could present any certificate and impersonate any server, defeating the confidentiality and integrity of the connection. HTTP/3 uses the same client and was equally affected. Handshakes authenticated by a PSK (session resumption) are not affected, because the peer is authenticated by the PSK binder and no certificate is sent. This is fixed in 1.4.4. The client now verifies the CertificateVerify signature, validates the certificate chain against the trust store (`cacerts` option, the operating system store by default), and checks the hostname. Client `verify` now defaults to on; set `verify => false` to accept any certificate (for example a self-signed test server). No known workarounds are available before 1.4.4. `verify => true` had no effect, and inspecting the certificate after connecting does not help because without the signature check the peer is never proven to own the certificate it presents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-49457
EUVD
EUVD-2026-58756

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
benoitc erlang_quic to 1.4.3 (inc)
benoitc erlang_quic 1.4.4
erlang_quic erlang_quic to 1.4.4 (exc)
erlang_quic erlang_quic From 1.4.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the erlang_quic package versions up to 1.4.3. The QUIC client did not properly authenticate the server during TLS 1.3 handshake. The CertificateVerify signature was not checked, certificate chain was not validated, and hostname was not compared against the certificate. This allowed a man-in-the-middle attacker to impersonate any server by presenting a fraudulent certificate, compromising connection confidentiality and integrity. HTTP/3 was also affected as it uses the same client code. The issue was patched in version 1.4.4 which now enforces proper certificate verification including signature checks, chain validation, and hostname matching.

Detection Guidance

To detect this vulnerability, check the version of erlang_quic in use. If your system runs versions up to 1.4.3, it is vulnerable. Run: erl -eval 'io:format("~s~n", [erlang_quic:module_info(version)]).' -- eval 'init:stop().' to check the installed version.

Impact Analysis

An attacker on the network path could intercept and decrypt traffic intended for a server, or impersonate the server to steal sensitive data. This affects confidentiality and integrity of all communications using affected versions of erlang_quic or HTTP/3. The high CVSS score of 9.1 indicates critical severity with no privileges or user interaction required for exploitation.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and secure communications. GDPR requires appropriate technical measures to ensure confidentiality and integrity of personal data. HIPAA mandates secure transmission of protected health information. The lack of proper TLS verification could result in unauthorized access to sensitive data, leading to potential compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade erlang_quic to version 1.4.4 or later immediately. If upgrading is not possible, disable QUIC client usage or ensure all connections use PSK-based session resumption, which is unaffected. Avoid disabling verification unless absolutely necessary for testing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49457. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart