Time-of-Check Time-of-Use Race Condition in Erlang/OTP DTLS Servers

CVE-2026-55950

What is CVE-2026-55950?

A vulnerability exists in the DTLS server listener of Erlang/OTP due to a time-of-check time-of-use (TOCTOU) race condition in the dtls_packet_demux module. This flaw allows an unauthenticated remote attacker to exploit the demux's key-value store by rapidly sending multiple ClientHello messages from the same source, leading to a crash of the shared dtls_packet_demux process. Consequently, this crash affects all active DTLS sessions on the listener, causing a denial of service to all clients without the need for authentication or specific configurations.

References