Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-55953: The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the

34
Routine
HIGH 7.4REMOTEUPGRADEUPGRADE

CVE-2026-55953 is a high-severity flaw (CVSS 7.4) affecting erlang\/otp, erlang\/ssl. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The

Why this priority

  • High severity
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score7.4 (High)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededNone
User interactionNone
EPSS exploit chance0.2% (top 86%)
CISA exploited listNo
WeaknessCWE-757
Published2026-07-27
Last modified2026-10-24
Publisher (CNA): EEF · Vendor: erlang

Share: LinkedIn · X · Reddit

Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

erlang erlang\/otp UPGRADE
Affected: >= 17.0 and < 27.3.4.15 · >= 28.0 and < 28.5.0.4 · >= 29.0 and < 29.0.4
Fixed in: 27.3.4.15, 28.5.0.4, 29.0.4
Safe to downgrade to: a release before 17.0
1. Check installed version
apt-cache policy erlangotp || rpm -q erlangotp || erlangotp --version
2. UPGRADE to 27.3.4.15 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade erlangotp
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade erlangotp
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 17.0 (Debian / Ubuntu)
apt-cache madison erlangotp sudo apt install erlangotp=<VERSION_BEFORE_17.0> sudo apt-mark hold erlangotp
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list erlangotp sudo dnf downgrade erlangotp-<VERSION_BEFORE_17.0> sudo dnf versionlock add erlangotp
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
erlang erlang\/ssl UPGRADE
Affected: >= 5.3.4 and < 11.2.12.11 · >= 11.3 and < 11.6.0.4 · >= 11.7 and < 11.7.4
Fixed in: 11.2.12.11, 11.6.0.4, 11.7.4
Safe to downgrade to: a release before 5.3.4
1. Check installed version
apt-cache policy erlangssl || rpm -q erlangssl || erlangssl --version
2. UPGRADE to 11.2.12.11 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade erlangssl
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade erlangssl
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 5.3.4 (Debian / Ubuntu)
apt-cache madison erlangssl sudo apt install erlangssl=<VERSION_BEFORE_5.3.4> sudo apt-mark hold erlangssl
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list erlangssl sudo dnf downgrade erlangssl-<VERSION_BEFORE_5.3.4> sudo dnf versionlock add erlangssl
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · sugar-abacus · FIXED · 61-18.fc46 · FEDORA-2026-b1e9de9204 · source
sudo dnf upgrade --advisory=FEDORA-2026-b1e9de9204
Fedora ELN · selinux-policy · FIXED · 45.23-1.eln159 · FEDORA-2026-3668c969a2 · source
sudo dnf upgrade --advisory=FEDORA-2026-3668c969a2
Debian 12 · erlang · NO FIX YET
Debian 13 · erlang · FIXED · 1:27.3.4.1+dfsg-1+deb13u3
sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:27.3.4.1+dfsg-1+deb13u3" && echo PATCHED || echo STILL-VULNERABLE

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-55953?

erlang\/otp: upgrade to 27.3.4.15, 28.5.0.4, 29.0.4; erlang\/ssl: upgrade to 11.2.12.11, 11.6.0.4, 11.7.4. Exact commands for each OS are on this page.

Is CVE-2026-55953 being exploited?

CVE-2026-55953 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-55953 affect?

CVE-2026-55953 affects erlang\/otp, erlang\/ssl. Severity is high (CVSS 7.4). The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler va

How urgent is CVE-2026-55953?

Priority 34/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.