Erlang/OTP ssl flaws let unauthenticated attackers crash DTLS and TLS 1.3 listeners

Two high-severity denial-of-service vulnerabilities in Erlang/OTP's ssl application allow unauthenticated remote attackers to disrupt secure listeners before authentication completes. CVE-2026-55950 affects the DTLS dtls_packet_demux component, where a time-of-check/time-of-use race condition can be triggered by rapidly sending multiple DTLS ClientHello messages from the same source IP address and port. Because the demultiplexing process is shared across DTLS associations on a listener, a successful crash terminates all active DTLS sessions on that listener rather than only the attacker's connection.

A second flaw, CVE-2026-55952, affects TLS 1.3 servers when malformed ClientHello pre-shared key data causes session ticket handling to crash after the software fails to validate that PSK identity and binder lists are the same length. A single crafted request can make TLS 1.3 unusable on an affected listener until the ssl application is restarted, while TLS 1.2 is not affected. Erlang/OTP maintainers released fixes in OTP 29.0.3, 28.5.0.3, and 27.3.4.14; the DTLS issue was addressed in a GitHub commit that changed logic in dtls_packet_demux.erl to safely handle existing keys during connection state transitions.