TLS Cipher Suite Validation Flaw in Erlang/OTP by Erlang Solutions

CVE-2026-55953

What is CVE-2026-55953?

The Erlang/OTP SSL/TLS client is vulnerable due to a failure to verify the selection of cipher suites during the handshake process. Specifically, the client does not restrict the cipher suites to those offered by the client, which allows an on-path attacker to negotiate an anonymous cipher suite, such as TLS_DH_anon or TLS_ECDH_anon. This leads to a significant security gap, as the server does not need to present any certificate, thereby allowing the attacker to bypass key verification processes. As a result, all communication following the handshake can be intercepted and modified without detection. This vulnerability impacts several OTP versions from 17.0 to 29.0.4.

References