The vulnerability lies in Erlang/OTP implementation. It is a CWE-1394 weakness involving improper initialization of a cryptographic key. During server startup, the DTLS cookie secret is initialized as an empty binary instead of a randomly generated value. Because HMAC with an empty key is deterministic, an attacker who can observe the plaintext ClientHello can compute a valid DTLS cookie using the formula provided in the RFC. Since the cookie is intended solely as a denial‑of‑service mitigation and not as an authentication mechanism, its predictability during the first 0‑15 seconds allows a spoofed source address to be accepted. This results in the server allocating resources for handshake attempts from forged addresses, potentially exhausting CPU or memory. The flaw does not grant code execution, privilege escalation, or data disclosure, but it introduces a mechanism for amplifying traffic against the target.

Erlang:OTP releases from version , 29.0.3 are affected, and the specific sub-releases 28.5.0.3 and 27.3.4.14 are also vulnerable. Corresponding ssl modules 8.2 prior to 11.7.3, 11.6.0.3 and 11.2.12.10 contain the flaw.

The CVSSifies the vulnerability as medium severity. The EPSS score of < 1 % indicates a very low probability that attackers will exploit this flaw in the near term. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no public exploits are known. to passively monitor a client’s ClientHello and act within the brief startup window before the server rotates its secret. Successful exploitation would lead to resource exhaustion or intermittent would not provide code execution or other higher‑level capabilities.