Security readout for executives and security teams
Plain-English summary
Before version 1.4.4, erlang_quic clients could not reliably confirm a server’s identity. An attacker positioned on the network path could impersonate a QUIC or HTTP/3 server, exposing or altering sensitive traffic. The flaw does not affect sessions authenticated through a pre-shared key.
Executive priority
Treat this as an urgent upgrade for affected clients, especially those operating across untrusted networks or carrying sensitive traffic. The CVSS score is 9.1, no pre-1.4.4 workaround is documented, and existing verification configurations did not provide protection.
Technical view
The client omitted TLS 1.3 CertificateVerify signature validation, certificate-chain validation, and hostname matching. Consequently, client verification settings were ineffective for certificate-authenticated handshakes. Version 1.4.4 adds signature, trust-chain, and hostname checks, using the configured CA certificates or operating-system trust store by default.
Likely exposure
Exposure is limited to applications using erlang_quic versions earlier than 1.4.4 as a QUIC or HTTP/3 client. Certificate-authenticated connections are affected, including when verification was explicitly enabled. PSK-authenticated resumed sessions are not affected. The sources do not identify specific downstream applications or deployments.
Exploitation context
Successful abuse requires an attacker able to intercept or manipulate the network path. The attacker could impersonate the intended server and compromise connection confidentiality and integrity. The supplied sources provide no evidence of known active exploitation, and the CVE is not identified as being in KEV.
Researcher notes
The core failure is incomplete peer authentication under TLS 1.3, mapped to CWE-295 and CWE-297. Certificate inspection alone was insufficient because the client did not prove that the peer owned the presented certificate. Assess initial certificate-based handshakes separately from PSK-authenticated resumptions.
Mitigation direction
- Upgrade every affected erlang_quic client dependency to version 1.4.4 or later.
- Prioritize HTTP/3 and QUIC clients carrying credentials, sensitive data, or integrity-critical traffic.
- Do not rely on verification settings or post-connection certificate inspection on older versions.
- Follow vendor guidance; the advisory states no workaround exists before version 1.4.4.
Validation and detection
- Inventory deployed and bundled erlang_quic versions, including transitive dependencies.
- Identify applications initiating QUIC or HTTP/3 connections with certificate-based TLS authentication.
- Confirm upgraded clients enable verification and use the intended CA trust store and hostname.
- Retest certificate rejection behavior after upgrading, without exposing production traffic.
- Separate PSK-resumed sessions from certificate-authenticated initial handshakes when assessing historical exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-297: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-49457 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/benoitc/erlang_quic/security/advisories/GHSA-2r8v-p65x-3663CVE reference, GitHub_M · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.