Description
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected.

An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker.

This issue affects OTP from OTP R13B03 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl from 3.10.7 before 11.2.12.11, from 11.3 before 11.6.0.4, and from 11.7 before 11.7.4. Whether OTP before OTP R13B03, corresponding to ssl before 3.10.7, is affected is unknown.
Published: 2026-07-27
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Erlang/OTP SSL client for TLS 1.2 and earlier does not verify that the cipher suite selected by the server during the handshake was among the suites offered by the client. An on‑path attacker can inject a ServerHello that selects an anonymous key‑exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_*. Because these suites do not require a server certificate, the usual peer verification and hostname checks are bypassed. The client accepts the connection and returns {ok, Socket}, treating it as authenticated. Consequently, an attacker can read and modify the entire application traffic. The defect affects OTP R13B03 releases before OTP 27.3.4.15, OTP 28.0 before OTP 28.5.0.4, and OTP 29.0 before OTP 29.0.4 (corresponding to ssl versions 3.10.7 before 11.2.12.11, 11.3 before 11.6.0.4, and 11.7 before 11.7.4).

Affected Systems

The flaw exists in Erlang/OTP releases from OTP R13B03 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl versions 3.10.7 before 11.2.12.11, 11.3 before 11.6.0.4, and 11.7 before 11.7.4. The status of OTP releases before OTP R13B03 is unknown. Any Erlang/OTP image built with these releases that uses TLS 1.2 or DTLS in client mode is vulnerable. Upgrading to OTP 29.0.4 or later (or any build that includes the patches in commits 064e2364, 0a82596d, e6ff9381) removes the defect.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.1, placing it in the high‑severity category. The EPSS score is < 1%, indicating a low probability of exploitation, but the defect still allows an on‑path attacker to achieve full traffic disclosure and tampering without any credentials. The attacker can choose any anonymous cipher suite, bypassing cryptographic verification. The TLS 1.3 client path is not affected because it performs the required membership check. The flaw is not listed in CISA KEV, yet organizations that use older OTP releases should treat the risk as high and remediate promptly. A temporary mitigation is to restrict clients to TLS 1.3 only by setting the ssl option versions to ['tlsv1.3'], which forces the proper check; this step can be taken until an upgrade can be applied.

Generated by OpenCVE AI on August 5, 2026 at 00:08 UTC.

Remediation

Vendor Workaround

* Restrict client connections to TLS 1.3 only by setting versions to ['tlsv1.3'] in the client's ssl options. The TLS 1.3 client path performs the required cipher suite membership check and is not affected.

OpenCVE Recommended Actions

  • Upgrade Erlang/OTP to version 29.0.4 or later, which includes the patch that enforces cipher suite membership checks.
  • If an immediate upgrade is not possible, reconfigure all clients to limit TLS usage to version 1.3 only by setting the ssl option versions to ['tlsv1.3'] so the proper check is performed.
  • Verify that no anonymous cipher suites are negotiated by inspecting ServerHello messages or enabling debug logging on the ssl application.

Generated by OpenCVE AI on August 5, 2026 at 00:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and 11.2.12.11. The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP R13B03 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl from 3.10.7 before 11.2.12.11, from 11.3 before 11.6.0.4, and from 11.7 before 11.7.4. Whether OTP before OTP R13B03, corresponding to ssl before 3.10.7, is affected is unknown.

Fri, 31 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-940
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

threat_severity

Important

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Erlang otp
Vendors & Products Erlang erlang/otp
Erlang otp

Mon, 27 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from 17.0 before 27.3.4.15, 28.5.0.4, and 29.0.4 corresponding to ssl from 5.3.4 before 11.2.12.11, 11.6.0.4, and 11.7.4. The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and 11.2.12.11.

Mon, 27 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from 17.0 before 27.3.4.15, 28.5.0.4, and 29.0.4 corresponding to ssl from 5.3.4 before 11.2.12.11, 11.6.0.4, and 11.7.4.
Title TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-757
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 9.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang/otp Erlang\/otp Erlang\/ssl Otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-03T21:44:17.335Z

Reserved: 2026-06-17T17:55:15.686Z

Link: CVE-2026-55953

cve-icon Vulnrichment

Updated: 2026-07-27T18:34:05.907Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T16:17:49.500

Modified: 2026-08-10T17:21:18.967

Link: CVE-2026-55953

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-27T15:21:29Z

Links: CVE-2026-55953 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T00:15:04Z

Weaknesses
  • CWE-757

    Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

  • CWE-940

    Improper Verification of Source of a Communication Channel