CVE-2026-54887: erlang/otp from 20.0 (inclusive), before 27.3.4.14 (exclusive), from 28.0 (inclusive), before 28.5.0.3 (exclusive)…

Affected technology

erlang/otp · from 20.0 (inclusive), before 27.3.4.14 (exclusive)
erlang

erlang/otp · from 28.0 (inclusive), before 28.5.0.3 (exclusive)
erlang

erlang/otp · from 29.0 (inclusive), before 29.0.3 (exclusive)
erlang

erlang/ssl · from 8.2 (inclusive), before 11.2.12.10 (exclusive)
erlang

erlang/ssl · from 11.3 (inclusive), before 11.6.0.3 (exclusive)
erlang

erlang/ssl · from 11.7 (inclusive), before 11.7.3 (exclusive)
erlang

OTP · 8.2 to before *; status changes: 11.7.3 — unaffected, 11.6.0.3 — unaffected, 11.2.12.10 — unaffected
Erlang

OTP · 20.0 to before *; status changes: 29.0.3 — unaffected, 28.5.0.3 — unaffected, 27.3.4.14 — unaffected, e594aad2f87aab39e99fccf9e021bc94e0bbf7d4 to before 888e3bcd72d5406016b9e0de741026bc2a6f114d
Erlang

Component: dtls_server_connection
Function: dtls_server_connection:initial_hello/3
File: src/dtls_server_connection.erl, lib/ssl/src/dtls_server_connection.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and integrity impact as none; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.