CVE-2026-55950

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 25.3 through 29.0.2 Erlang/OTP versions 28.x prior to 28.5.0.3 Erlang/OTP versions 27.x prior to 27.3.4.14 ssl versions 10.9 through 11.7.2 ssl versions 11.6.x prior to 11.6.0.3 ssl versions 11.2.x prior to 11.2.12.10

Description A Time-of-check Time-of-use (TOCTOU) race condition exists in the dtls packet demux module within the ssl component. This occurs when a DTLS server listener uses a shared dtls packet demux gen server process to route UDP datagrams. An unauthenticated remote attacker can trigger a crash by rapidly sending multiple ClientHello messages from the same source address and port. This creates a race condition in the internal gb trees key-value store, resulting in a {key exists, {old, Client}} crash that terminates the demux process. Since this process is shared, all active DTLS sessions on the listener are terminated, leading to a persistent denial of service. The issue is located in the file lib/ssl/src/dtls packet demux.erl and only affects deployments using ssl:listen/2 with UDP-based transport.

Recommendations Update Erlang/OTP to version 29.0.3 or later. Update Erlang/OTP to version 28.5.0.3 or later. Update Erlang/OTP to version 27.3.4.14 or later. Update ssl to version 11.7.3 or later. Update ssl to version 11.6.0.3 or later. Update ssl to version 11.2.12.10 or later.