Loading story…
Two high-severity denial-of-service vulnerabilities in Erlang/OTP's ssl application allow unauthenticated remote attackers to disrupt secure listeners before authentication completes. CVE-2026-55950 affects the DTLS dtls_packet_demux component, where a time-of-check/time-of-use race condition can be triggered by rapidly sending multiple DTLS ClientHello messages from the same source IP address and port. Because the demultiplexing process is shared across DTLS associations on a listener, a successful crash terminates all active DTLS sessions on that listener rather than only the attacker's connection.
A second flaw, CVE-2026-55952, affects TLS 1.3 servers when malformed ClientHello pre-shared key data causes session ticket handling to crash after the software fails to validate that PSK identity and binder lists are the same length. A single crafted request can make TLS 1.3 unusable on an affected listener until the ssl application is restarted, while TLS 1.2 is not affected. Erlang/OTP maintainers released fixes in OTP 29.0.3, 28.5.0.3, and 27.3.4.14; the DTLS issue was addressed in a GitHub commit that changed logic in dtls_packet_demux.erl to safely handle existing keys during connection state transitions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-55952 was publicly documented as a high-severity denial-of-service vulnerability in Erlang/OTP's SSL application affecting TLS 1.3 servers. A malformed ClientHello pre-shared key extension can crash session ticket handling on an affected listener until the SSL application is restarted.
CVE-2026-55950 was publicly documented as a high-severity Erlang/OTP SSL vulnerability in dtls_packet_demux that lets an unauthenticated attacker crash the shared DTLS demux process and terminate all active DTLS sessions on a listener. Affected versions and fixed releases were identified in the disclosure.
A GitHub commit in the erlang/otp repository fixed a DTLS race condition in the SSL component that could be used for denial-of-service attacks against DTLS servers. The commit was made by IngelaAndin and tagged for OTP-29.0.3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceosv.dev
Open sourcegithub.com
Open sourcegithub.com
Open sourcecna.erlef.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity memory-corruption vulnerabilities were disclosed in widely used TLS-related software components. **CVE-2026-5264** affects wolfSSL and stems from DTLS 1.3 ACK message processing, where a remote attacker can send a crafted ACK packet to trigger a heap buffer overflow. The flaw is classified as `CWE-122` and is network-reachable with low attack complexity and no privileges or user interaction required, raising concern for applications that expose DTLS 1.3 services. A separate flaw, **CVE-2026-5402**, was disclosed in Wireshark’s TLS protocol dissector and affects versions `4.6.0` through `4.6.4`. The vulnerability is also a heap-based buffer overflow (`CWE-122`) and could allow denial of service and possible code execution when malicious traffic is processed, with the CVSS vector indicating high impact to confidentiality, integrity, and availability. Public references point to a wolfSSL GitHub pull request for the DTLS issue and to a GitLab issue and official Wireshark security advisory for the dissector flaw.
Jun 29, 2026
Erlang/OTP disclosed **CVE-2026-49759**, a high-severity stack buffer overflow in the `inet_drv` SCTP error-cause parsing path that can let an unauthenticated remote attacker crash the BEAM VM. The flaw is in `sctp_parse_error_chunk` in `erts/emulator/drivers/common/inet_drv.c`, where crafted SCTP `ERROR` chunks can overflow a fixed-size stack buffer while cause codes are converted into `ErlDrvTermData` entries. Exploitation requires SCTP support to be enabled, a listening SCTP socket to be exposed through `gen_sctp` using the default `inet` backend, and network reachability to that port; Windows builds are not affected because SCTP is unsupported there. Advisories and the upstream patch indicate the issue is primarily **denial of service**, not expected remote code execution, because stack protections should terminate the process before meaningful control of execution is possible and the overwrite pattern is constrained. A crafted packet may also leak limited Erlang VM memory in an error response. The vulnerability affects OTP releases from **17.0** up to but excluding **27.3.4.13**, **28.5.0.2**, and **29.0.2**. The fix adds bounds checking and truncation safeguards in SCTP parsing and related async-event handling to prevent output term buffer overruns during malformed packet processing.
Jun 29, 2026
OpenSSL disclosed a broad set of vulnerabilities affecting ASN.1 parsing, PKCS#12, CMS/PKCS#7, QUIC, OCSP, CMP/CRMF, DH key validation, AEAD cipher handling, and certificate and email validation across the 4.0, 3.6, 3.5, 3.4, and 3.0 branches. The most severe issue, **CVE-2026-45447**, is a high-severity heap use-after-free in `PKCS7_verify()` that can be triggered by specially crafted PKCS#7 or S/MIME signed messages and could lead to crashes, heap corruption, or potentially remote code execution. The advisory also details moderate-severity flaws that could enable forged CMS `AuthEnvelopedData` messages, denial-of-service conditions in QUIC and OCSP processing, a TLS client double-free via OCSP stapling, a QUIC server `NULL` dereference, and cryptographic failures in AES-OCB when applications use the `EVP_Cipher()` one-shot API, alongside numerous lower-severity parsing, validation, and bounds-checking bugs. OpenSSL said most issues were fixed in **4.0.1**, **3.6.3**, **3.5.7**, **3.4.6**, and **3.0.21**, with **1.1.1zh** and **1.0.2zq** issued for supported legacy customers; most flaws were reported as outside the OpenSSL FIPS module boundary, except **CVE-2026-42770**, which affects FIPS modules in multiple supported branches.
Jun 29, 2026