CVE-2026-55953
Full vulnerability record from the local CVENow database.
Description
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP 17.0 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl from 5.3.4 before 11.2.12.11, from 11.3 before 11.6.0.4, and from 11.7 before 11.7.4. Whether OTP before OTP 17.0, corresponding to ssl before 5.3.4, is affected is unknown.
Severity
CRITICAL
CVSS score
9.1
(v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-07-27 16:17:49.500000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-55953",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-07-27T16:17:49.500",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected.\n\nAn on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl from 5.3.4 before 11.2.12.11, from 11.3 before 11.6.0.4, and from 11.7 before 11.7.4. Whether OTP before OTP 17.0, corresponding to ssl before 5.3.4, is affected is unknown."
},
{
"lang": "es",
"value": "El cliente Erlang/OTP ssl TLS 1.2 (y anteriores) y DTLS no verifica que el conjunto de cifrado seleccionado por el servidor en ServerHello estuviera entre los conjuntos ofrecidos por el cliente en ClientHello. El gestor tls_handshake:hello/5 del lado del cliente valida la versión del protocolo negociado y el centinela de degradación, pero entrega el conjunto elegido por el servidor directamente a ssl_handshake:handle_server_hello_extensions/9, que lo instala sin una verificación de pertenencia. La ruta del cliente TLS 1.3 realiza esta verificación (según RFC 8446), por lo que no se ve afectada.\n\nUn atacante en la ruta entre el cliente y el servidor previsto puede responder con un ServerHello seleccionando un conjunto de intercambio de claves anónimo como TLS_DH_anon_* o TLS_ECDH_anon_* que el cliente nunca ofreció. Los conjuntos anónimos no requieren que el servidor presente un certificado, por lo que se omite toda la configuración de verify_peer y cacerts: el atacante completa el handshake con sus propios parámetros efímeros, no se valida ningún certificado, no se verifica ningún nombre de host, y ssl:connect devuelve {ok, Socket}. Todo el tráfico de aplicación posterior es legible y modificable por el atacante.\n\nEste problema afecta a OTP desde OTP 17.0 antes de OTP 29.0.4, OTP 28.5.0.4 y OTP 27.3.4.15, lo que corresponde a ssl desde 5.3.4 antes de 11.7.4, 11.6.0.4 y 11.2.12.11."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unaffected",
"packageName": "otp",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"tls_handshake",
"ssl_handshake",
"ssl"
],
"programFiles": [
"lib/ssl/src/tls_handshake.erl",
"lib/ssl/src/ssl_handshake.erl",
"lib/ssl/src/ssl.erl"
],
"programRoutines": [
{
"name": "tls_handshake:hello/5"
},
{
"name": "ssl_handshake:handle_server_hello_extensions/9"
},
{
"name": "ssl:connect/2"
},
{
"name": "ssl:connect/3"
},
{
"name": "ssl:connect/4"
}
],
"packageURL": "pkg:software-id/erlang.org/otp",
"versions": [
{
"version": "0",
"lessThan": "17.0",
"versionType": "otp",
"status": "unknown"
},
{
"version": "17.0",
"lessThan": "27.3.4.15",
"versionType": "otp",
"status": "affected"
},
{
"version": "28.0",
"lessThan": "28.5.0.4",
"versionType": "otp",
"status": "affected"
},
{
"version": "29.0",
"lessThan": "29.0.4",
"versionType": "otp",
"status": "affected"
}
]
},
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unaffected",
"packageName": "ssl",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"tls_handshake",
"ssl_handshake",
"ssl"
],
"programFiles": [
"src/tls_handshake.erl",
"src/ssl_handshake.erl",
"src/ssl.erl"
],
"programRoutines": [
{
"name": "tls_handshake:hello/5"
},
{
"name": "ssl_handshake:handle_server_hello_extensions/9"
},
{
"name": "ssl:connect/2"
},
{
"name": "ssl:connect/3"
},
{
"name": "ssl:connect/4"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"versions": [
{
"version": "0",
"lessThan": "5.3.4",
"versionType": "otp",
"status": "unknown"
},
{
"version": "5.3.4",
"lessThan": "11.2.12.11",
"versionType": "otp",
"status": "affected"
},
{
"version": "11.3",
"lessThan": "11.6.0.4",
"versionType": "otp",
"status": "affected"
},
{
"version": "11.7",
"lessThan": "11.7.4",
"versionType": "otp",
"status": "affected"
}
]
},
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com",
"packageName": "erlang/otp",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"tls_handshake",
"ssl_handshake",
"ssl"
],
"programFiles": [
"lib/ssl/src/tls_handshake.erl",
"lib/ssl/src/ssl_handshake.erl",
"lib/ssl/src/ssl.erl"
],
"programRoutines": [
{
"name": "tls_handshake:hello/5"
},
{
"name": "ssl_handshake:handle_server_hello_extensions/9"
},
{
"name": "ssl:connect/2"
},
{
"name": "ssl:connect/3"
},
{
"name": "ssl:connect/4"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"versions": [
{
"version": "84adefa331c4159d432d22840663c38f155cd4c1",
"lessThan": "*",
"versionType": "git",
"status": "affected",
"changes": [
{
"at": "064e236414614f9085cbbbd6eacf0e43c02d1b4b",
"status": "unaffected"
},
{
"at": "0a82596d425abe43dc2e0b3d74aa1557ef74051c",
"status": "unaffected"
},
{
"at": "e6ff938116b2872bccc478af7fefb56627285b77",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-27T18:33:59.966358Z",
"id": "CVE-2026-55953",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-757"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "17.0",
"versionEndExcluding": "27.3.4.15",
"matchCriteriaId": "028E6EFC-A548-4F28-B08E-8636A2470B97"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "28.0",
"versionEndExcluding": "28.5.0.4",
"matchCriteriaId": "E5A403B9-F8C0-42F9-9CDD-AE95FBBA58BC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "29.0",
"versionEndExcluding": "29.0.4",
"matchCriteriaId": "4325E198-43FA-4DD1-99A5-66705CF21615"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.3.4",
"versionEndExcluding": "11.2.12.11",
"matchCriteriaId": "07A34CB3-BA91-4CF3-BB1C-AFE7779A3DB1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.3",
"versionEndExcluding": "11.6.0.4",
"matchCriteriaId": "00A0557D-8DF6-4DD2-AE3A-6F732454D8B8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.7",
"versionEndExcluding": "11.7.4",
"matchCriteriaId": "50DDEF08-5FC7-40C5-B9C5-4791B0EC7595"
}
]
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-55953.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
]
},
{
"url": "https://github.com/erlang/otp/commit/064e236414614f9085cbbbd6eacf0e43c02d1b4b",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/erlang/otp/commit/0a82596d425abe43dc2e0b3d74aa1557ef74051c",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/erlang/otp/commit/e6ff938116b2872bccc478af7fefb56627285b77",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55953",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch",
"Third Party Advisory"
]
},
{
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Release Notes"
]
}
]
}