CVE-2020-35733 Security feature bypass in n/a
The Erlang SSL application incorrectly accepts invalid certificate chains, allowing attackers to bypass certificate validation mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35733?
CVE-2020-35733 is a high-severity vulnerability in Fedoraproject Fedora, published on 15 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority.
Weakness: CWE-295
Which versions are affected by CVE-2020-35733?
It affects 2 products.
Products include Erlang Erlang\/Otp, Fedoraproject Fedora.
How do I fix CVE-2020-35733?
Upgrade to a fixed version.
Is CVE-2020-35733 being exploited?
There is no known exploitation of CVE-2020-35733 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2022-37026 Auth bypass in n/a
- CVE-2016-10253 Memory corruption in n/a
- CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
- CVE-2026-49759 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
- CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
Sources
Also known as CLEANSTART-2026-CB96630, DEBIAN-CVE-2020-35733, GHSA-xg86-vxqv-4j86.