Loading vulnerability…
DTLS Listener Denial of Service in Erlang/OTP dtls_packet_demux
CVE-2026-55950 is a time-of-check time-of-use race condition in the Erlang/OTP ssl application's dtls_packet_demux module. Each DTLS listener uses a shared gen_server process to route incoming UDP datagrams to connection handlers. Rapid reconnections using valid ClientHello messages from the same source address and port can race with processing of an intermediate DOWN monitor message, causing a duplicate-key exception in the internal gb_trees store. This terminates the shared demultiplexer and every active DTLS session on that listener. Affected routines include handle_call/3, handle_info/2, and new_connection/2. Affected releases begin with OTP 25.3, corresponding to ssl 10.9; fixes are available in OTP 29.0.3, 28.5.0.3, and 27.3.4.14. TLS-only deployments are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can terminate all active DTLS sessions on an affected listener, disrupting legitimate clients rather than only the attacker's connection. Repeated triggering can sustain denial of service indefinitely. The identified impact is availability loss; no confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
No specific temporary workaround is documented. TLS-only deployments are unaffected; the vulnerability requires an affected DTLS server listener.
Patch, then assume compromise.
Upgrade to the fixed release for the applicable Erlang/OTP branch: OTP 29.0.3, 28.5.0.3, or 27.3.4.14, corresponding respectively to ssl 11.7.3, 11.6.0.3, and 11.2.12.10, or a later release containing the fix. Distribution-maintained installations should apply the vendor's patched Erlang packages. For Debian stable (trixie), upgrade to 1:27.3.4.1+dfsg-1+deb13u3 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.