CVE-2026-55950: erlang/otp from 25.3 (inclusive), before 27.3.4.14 (exclusive), from 28.0 (inclusive), before 28.5.0.3 (exclusive)…

Affected technology

erlang/otp · from 25.3 (inclusive), before 27.3.4.14 (exclusive)
erlang

erlang/otp · from 28.0 (inclusive), before 28.5.0.3 (exclusive)
erlang

erlang/otp · from 29.0 (inclusive), before 29.0.3 (exclusive)
erlang

erlang/ssl · from 10.9 (inclusive), before 11.2.12.10 (exclusive)
erlang

erlang/ssl · from 11.3 (inclusive), before 11.6.0.3 (exclusive)
erlang

erlang/ssl · from 11.7 (inclusive), before 11.7.3 (exclusive)
erlang

OTP · 10.9 to before *; status changes: 11.7.3 — unaffected, 11.6.0.3 — unaffected, 11.2.12.10 — unaffected
Erlang

OTP · 25.3 to before *; status changes: 29.0.3 — unaffected, 28.5.0.3 — unaffected, 27.3.4.14 — unaffected, 44dcb4c3d900777493ce2a6129f451aa475811f9 to before e44d2bf01c4473ef2ea7f09e3523cf96de6e4a04
Erlang

Component: dtls_packet_demux
Function: dtls_packet_demux:handle_call/3, dtls_packet_demux:handle_info/2, dtls_packet_demux:new_connection/2
File: src/dtls_packet_demux.erl, lib/ssl/src/dtls_packet_demux.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can crash all active DTLS sessions on a listener. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.