CVE-2026-55953: erlang/otp from 17.0 (inclusive), before 27.3.4.15 (exclusive), from 28.0 (inclusive), before 28.5.0.4 (exclusive)…

Affected technology

erlang/otp · from 17.0 (inclusive), before 27.3.4.15 (exclusive)
erlang

erlang/otp · from 28.0 (inclusive), before 28.5.0.4 (exclusive)
erlang

erlang/otp · from 29.0 (inclusive), before 29.0.4 (exclusive)
erlang

erlang/ssl · from 5.3.4 (inclusive), before 11.2.12.11 (exclusive)
erlang

erlang/ssl · from 11.3 (inclusive), before 11.6.0.4 (exclusive)
erlang

erlang/ssl · from 11.7 (inclusive), before 11.7.4 (exclusive)
erlang

OTP · 17.0 to before 27.3.4.15, 28.0 to before 28.5.0.4, 29.0 to before 29.0.4
Erlang

OTP · 5.3.4 to before 11.2.12.11, 11.3 to before 11.6.0.4, 11.7 to before 11.7.4
Erlang

OTP · 84adefa331c4159d432d22840663c38f155cd4c1 to before *; status changes: 064e236414614f9085cbbbd6eacf0e43c02d1b4b — unaffected, 0a82596d425abe43dc2e0b3d74aa1557ef74051c — unaffected, e6ff938116b2872bccc478af7fefb56627285b77 — unaffected
Erlang

Component: tls_handshake, ssl_handshake, ssl
Function: tls_handshake:hello/5, ssl_handshake:handle_server_hello_extensions/9, ssl:connect/2, ssl:connect/3, ssl:connect/4
File: lib/ssl/src/tls_handshake.erl, lib/ssl/src/ssl_handshake.erl, lib/ssl/src/ssl.erl, src/tls_handshake.erl, src/ssl_handshake.erl, src/ssl.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.