Loading vulnerability…
Erlang/OTP TLS and DTLS Client Server Authentication Bypass
CVE-2026-55953 is a cipher-suite negotiation vulnerability in Erlang/OTP ssl clients using TLS 1.2 or earlier, or DTLS. The client-side tls_handshake:hello/5 handler checks the negotiated protocol version and downgrade sentinel but passes the server-selected cipher suite to ssl_handshake:handle_server_hello_extensions/9 without verifying that it was offered in ClientHello. An on-path attacker can select an unoffered anonymous key-exchange suite and complete the handshake using attacker-controlled ephemeral parameters. Because anonymous suites require no server certificate, certificate and hostname validation are bypassed even when verify_peer and cacerts are configured, and ssl:connect reports success. Affected OTP ranges are 17.0 before 27.3.4.15, 28.0 before 28.5.0.4, and 29.0 before 29.0.4; corresponding ssl ranges are 5.3.4 before 11.2.12.11, 11.3 before 11.6.0.4, and 11.7 before 11.7.4. The status of earlier versions is unknown. TLS 1.3 clients perform the required membership check and are unaffected; Erlang/OTP servers are also unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation defeats server authentication and compromises the confidentiality and integrity of subsequent application traffic on the affected connection. An attacker can impersonate the intended server, read transmitted application data, and modify responses or other traffic despite configured certificate trust and peer-verification controls. No direct availability impact or arbitrary code execution is established.
If you can’t patch tonight, do this now.
Until patched, restrict Erlang/OTP client connections to TLS 1.3 by setting the ssl versions option to ['tlsv1.3'], where supported by the application and remote endpoint. This workaround does not cover DTLS or connections requiring older TLS versions. Do not rely on verify_peer, cacerts, or merely omitting anonymous suites from the offered cipher list: the vulnerability bypasses those protections by accepting an unoffered suite.
Patch, then assume compromise.
Upgrade to a fixed release on the applicable branch: Erlang/OTP 27.3.4.15, 28.5.0.4, or 29.0.4, or a later fixed release. The corresponding fixed ssl versions are 11.2.12.11, 11.6.0.4, and 11.7.4. Distribution-packaged installations can instead apply vendor security updates containing backported fixes. The correction must enforce that the server-selected cipher suite belongs to the set offered by the client.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.