A Time‑of‑Check Time‑of‑Use (TOCTOU) race condition in Erlang/OTP's SSL DTLS demultiplexer allows an unauthenticated remote attacker to crash the shared demux process, terminating all active DTLS sessions on the listener and causing a denial of service. The flaw occurs when a DTLS client reconnects rapidly from the same source address and port, sending multiple ClientHello messages; the race condition in the demux's internal key‑value store triggers a crash. The attacker only needs to send valid ClientHello UDP packets from the same source IP and port before the gen_server handles the DOWN monitor message. No authentication, credentials, or special configuration is required, and the crash can be repeated indefinitely, creating a persistent denial of service. The vulnerability exemplifies a classic availability weakness, categorized as CWE‑367.

The flaw affects Erlang:OTP releases 25.3 up to but not including 29.0.3, 28.5.0.3, and 27.3.4.14. The corresponding SSL libraries affected are 10.9 up to but not including 11.7.3, 11.6.0.3, and 11.2.12.10 respectively. The fault lies in lib/ssl/src/dtls_packet_demux.erl and impacts any DTLS server listener that uses a single shared demux process to route UDP packets.

Based on the description, it is inferred that the likely attack vector is remote network via UDP, as the attacker needs only to send ClientHello packets from the same source IP and port. No authentication or special configuration is required, making the exploit trivial for an attacker with UDP connectivity to the listener. The CVSS score of 8.7 indicates high severity. The EPSS score of < 1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog, but the crash can be repeated indefinitely, raising the overall risk for all clients of the affected listener.