Read the docs
TI-2026-40359 Aliases CVE-2026-55953

TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

Priority MEDIUM 41CWE-757Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP 17.0 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl from 5.3.4 before 11.2.12.11, from 11.3 before 11.6.0.4, and from 11.7 before 11.7.4. Whether OTP before OTP 17.0, corresponding to ssl before 5.3.4, is affected is unknown.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Fix Partial OTP (Erlang): 27.3.4.15, 28.5.0.4, 29.0.4 +3Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ErlangOTP17.0 to before 27.3.4.15; 28.0 to before 28.5.0.4; 29.0 to before 29.0.427.3.4.15, 28.5.0.4, 29.0.4Patch availableCNA
ErlangOTP5.3.4 to before 11.2.12.11; 11.3 to before 11.6.0.4; 11.7 to before 11.7.411.2.12.11, 11.6.0.4, 11.7.4Patch availableCNA
  • OTP VendorErlang Affected 17.0 to before 27.3.4.15; 28.0 to before 28.5.0.4; 29.0 to before 29.0.4 Fixed in 27.3.4.15, 28.5.0.4, 29.0.4 Patch available CNA
  • OTP VendorErlang Affected 5.3.4 to before 11.2.12.11; 11.3 to before 11.6.0.4; 11.7 to before 11.7.4 Fixed in 11.2.12.11, 11.6.0.4, 11.7.4 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*17.0 to before 27.3.4.15; 28.0 to before 28.5.0.4; 29.0 to before 29.0.4VulnerableErlang
cpe:2.3:a:erlang:erlang\/ssl:*:*:*:*:*:*:*:*5.3.4 to before 11.2.12.11; 11.3 to before 11.6.0.4; 11.7 to before 11.7.4VulnerableErlang
  • cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions 17.0 to before 27.3.4.15; 28.0 to before 28.5.0.4; 29.0 to before 29.0.4 Vulnerable ·Erlang
  • cpe:2.3:a:erlang:erlang\/ssl:*:*:*:*:*:*:*:* Versions 5.3.4 to before 11.2.12.11; 11.3 to before 11.6.0.4; 11.7 to before 11.7.4 Vulnerable ·Erlang

Remediation

  • Fix · CNA OTP (Erlang) Fixed in 27.3.4.15, 28.5.0.4, 29.0.4
  • Fix · CNA OTP (Erlang) Fixed in 11.2.12.11, 11.6.0.4, 11.7.4

Red Hat 1 advisory

  • RHSA-2026:47009 Released 2026-07-28 · Red Hat rating Critical
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images erlang27-27.3.4.15-0.1.hum1@aarch64, erlang27-27.3.4.15-0.1.hum1@src, erlang27-27.3.4.15-0.1.hum1@x86_64 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Erlang OTP 17.0, 27.3.4.15 and 2 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-42390 Megaco flex scanner buffer overflow via oversized property parm namePriority LOW 37
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:47009

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55953

References

Patch 5

Advisory 1

Other 1

  • TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2017-14604 The Erlang otp TLS server answers with different TLS alerts to different error types in… CVSS 3.0MEDIUM 5.9
  • TI-2026-36669 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash CVSS 4.0HIGH 8.8
  • TI-2022-17230 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a… CVSS 3.1CRITICAL 9.8
  • TI-2016-08327 An issue was discovered in Erlang/OTP 18.x. CVSS 3.0CRITICAL 9.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences