CVE-2026-55953

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.14 Erlang/OTP versions 28.0 through 28.5.0.3 Erlang/OTP versions 29.0 through 29.0.3 ssl versions 5.3.4 through 11.2.12.10 ssl versions 11.6.0 through 11.6.0.3 ssl versions 11.7.0 through 11.7.3

Description The TLS 1.2 (and earlier) and DTLS client fails to verify if the cipher suite selected by the server in the ServerHello message was actually offered by the client in the ClientHello message. The tls handshake:hello/5 handler validates the protocol version and downgrade sentinel but passes the server-chosen suite to ssl handshake:handle server hello extensions/9 without a membership check. An on-path attacker can force the use of anonymous key exchange suites, such as TLS DH anon * or TLS ECDH anon *, which do not require server certificates. This bypasses the verify peer and cacerts configurations, allowing the attacker to complete the handshake without certificate or hostname validation, making all subsequent application traffic readable and modifiable.

Recommendations Update Erlang/OTP to version 27.3.4.15 or later. Update Erlang/OTP to version 28.5.0.4 or later. Update Erlang/OTP to version 29.0.4 or later. Update ssl to version 11.2.12.11 or later. Update ssl to version 11.6.0.4 or later. Update ssl to version 11.7.4 or later. Restrict client connections to TLS 1.3 only by setting versions to ['tlsv1.3'] in the client's ssl options.