Skip to main content

Erlang/OTP CVE-2026-54887

| EUVDEUVD-2026-41411 MEDIUM
Use of Default Cryptographic Key (CWE-1394)
2026-07-02 EEF
Authentication Bypass Otp Suse
6.3
CVSS 4.0 · Vendor: EEF
Share

Severity by source

Vendor (EEF) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

Network-reachable with no auth required, but the 15-second timing window constraint elevates AC to H; impact is availability-only with no data exposure.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 02, 2026 - 17:23 vuln.today

DescriptionCVE.org

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.

On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 §4.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext ClientHello can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses.

This vulnerability is associated with program file lib/ssl/src/dtls_server_connection.erl and program routine dtls_server_connection:initial_hello/3.

This issue affects OTP from OTP 20.0 before 29.0.3, 28.5.0.3 and 27.3.4.14 corresponding to ssl from 8.2 before 11.7.3, 11.6.0.3 and 11.2.12.10.

AnalysisAI

The DTLS server in Erlang/OTP ssl initializes its cookie secret to a hardcoded empty binary on startup, making HMAC-based cookie computation deterministic and fully predictable to any network observer for the 0-to-15-second window before the first secret rotation. Any attacker who can observe a plaintext DTLS ClientHello during this window can forge valid cookies, bypassing the RFC 6347 §4.2.1 source address verification mechanism and enabling handshake amplification attacks with spoofed source IPs. No public exploit has been identified at time of analysis; vendor-released patches are available in OTP 29.0.3, 28.5.0.3, and 27.3.4.14.

Technical ContextAI

DTLS (Datagram Transport Layer Security) extends TLS over UDP and incorporates a stateless cookie exchange (RFC 6347 §4.2.1) to prevent denial-of-service attacks from spoofed source addresses; the cookie is an HMAC over the client IP, port, and ClientHello, keyed by a server-side secret. In Erlang/OTP's ssl library, the function dtls_server_connection:initial_hello/3 in lib/ssl/src/dtls_server_connection.erl initializes previous_cookie_secret to the empty binary (<<>>) rather than a cryptographically random value. Because HMAC with an empty key is entirely deterministic, the computation dtls_handshake:cookie(<<>>, IP, Port, Hello) produces a value that any observer of the plaintext ClientHello can reproduce independently. This is a textbook instance of CWE-1394 (Use of Default Cryptographic Key): a security-sensitive secret initialized to a known constant, defeating the randomness property on which the mechanism depends. The vulnerability spans OTP versions from 20.0 through pre-patch releases of the 27, 28, and 29 branches, as identified by CPE cpe:2.3:a:erlang:otp.

RemediationAI

Upgrade Erlang/OTP to version 29.0.3, 28.5.0.3, or 27.3.4.14 (corresponding to ssl library versions 11.7.3, 11.6.0.3, or 11.2.12.10 respectively), which replace the hardcoded empty-binary initial cookie secret with a cryptographically random value. The fix commit is publicly available at https://github.com/erlang/otp/commit/888e3bcd72d5406016b9e0de741026bc2a6f114d and the vendor advisory at https://github.com/erlang/otp/security/advisories/GHSA-p2m2-3c2w-8jp8. If patching is not immediately possible, applying BCP38-compliant ingress filtering to block inbound UDP packets with spoofed source addresses at the network border prevents the amplification use case, though it does not eliminate the predictable cookie computation itself and offers no protection against on-path attackers within the trusted perimeter. Additionally, restricting DTLS listener exposure to trusted network segments reduces the feasibility of observing plaintext ClientHellos. Neither workaround substitutes for patching.

More in Otp

View all
CVE-2022-24584 MEDIUM POC
6.5 May 11

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
CVE-2026-49759 HIGH
8.8 Jun 10

Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by

CVE-2026-55950 HIGH
8.7 Jul 02

Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
CVE-2026-58227 HIGH
8.7 Jul 27

Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
CVE-2026-59250 HIGH
8.3 Jul 27

We need to output a JSON object based on the CVE-2026-59250 data. We must synthesize from multiple sources: description,
CVE-2026-28808 HIGH
8.3 Apr 07

Authorization bypass in Erlang OTP's inets HTTP server allows unanauthenticated remote attackers to execute CGI scripts

CVE-2026-55952 HIGH
8.2 Jul 02

Denial of service in the Erlang/OTP ssl application (OTP 22.2 through 29.0.3, and the 28.5.x/27.3.x maintenance branches
CVE-2026-32144 HIGH
7.6 Apr 07

Erlang OTP public_key module (versions 1.16 through 1.20.3 and 1.17.1.2) fails to cryptographically verify OCSP responde
CVE-2026-48860 HIGH
7.5 Jun 10

Authentication bypass in Erlang/OTP's TLS distribution module (inet_tls_dist) lets any attacker holding a TLS certificat
CVE-2026-48856 HIGH
7.1 Jun 10

Credential leakage in Erlang/OTP's inets httpc client (versions 17.0 through 29.0.2, 28.5.0.2, and 27.3.4.13) allows att
CVE-2026-23941 HIGH
7.0 Mar 13

A critical HTTP Request Smuggling vulnerability exists in Erlang OTP's inets httpd module that allows attackers to desyn

Same weakness CWE-1394 – Use of Default Cryptographic Key

View all
CVE-2025-41742 CRITICAL
9.8
CVE-2024-48956 CRITICAL
9.8
CVE-2025-41744 CRITICAL
9.1
CVE-2024-1275 CRITICAL
9.1
CVE-2024-29037 CRITICAL
9.1
CVE-2025-26849 MEDIUM POC
4.3
CVE-2026-5039 MEDIUM
6.1
CVE-2024-10748 LOW POC
2.0

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-54887 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy