CVE-2026-55953
TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
Description
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and 11.2.12.11.
INFO
Published Date :
July 27, 2026, 4:17 p.m.
Last Modified :
July 27, 2026, 4:17 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | CRITICAL | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | CRITICAL | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update Erlang/OTP to a version with the ssl fix.
- Ensure the client verifies server-chosen cipher suites.
- Disable anonymous cipher suites if possible.
- Monitor network traffic for anomalies.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-55953.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-55953 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-55953
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-55953 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-55953 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jul. 27, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['tls_handshake', 'ssl_handshake', 'ssl'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '11.7.4', 'status': 'unaffected'}, {'at': '11.6.0.4', 'status': 'unaffected'}, {'at': '11.2.12.11', 'status': 'unaffected'}], 'version': '5.3.4', 'lessThan': '*', 'versionType': 'otp'}], 'packageURL': 'pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git', 'packageName': 'ssl', 'programFiles': ['src/tls_handshake.erl', 'src/ssl_handshake.erl'], 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'tls_handshake:hello/5'}, {'name': 'ssl_handshake:handle_server_hello_extensions/9'}, {'name': 'ssl:connect/2'}, {'name': 'ssl:connect/3'}, {'name': 'ssl:connect/4'}]}, {'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['tls_handshake', 'ssl_handshake', 'ssl'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '29.0.4', 'status': 'unaffected'}, {'at': '28.5.0.4', 'status': 'unaffected'}, {'at': '27.3.4.15', 'status': 'unaffected'}], 'version': '17.0', 'lessThan': '*', 'versionType': 'otp'}, {'status': 'affected', 'changes': [{'at': '064e236414614f9085cbbbd6eacf0e43c02d1b4b', 'status': 'unaffected'}, {'at': '0a82596d425abe43dc2e0b3d74aa1557ef74051c', 'status': 'unaffected'}, {'at': 'e6ff938116b2872bccc478af7fefb56627285b77', 'status': 'unaffected'}], 'version': '84adefa331c4159d432d22840663c38f155cd4c1', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/erlang/otp', 'packageName': 'erlang/otp', 'programFiles': ['lib/ssl/src/tls_handshake.erl', 'lib/ssl/src/ssl_handshake.erl'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'tls_handshake:hello/5'}, {'name': 'ssl_handshake:handle_server_hello_extensions/9'}, {'name': 'ssl:connect/2'}, {'name': 'ssl:connect/3'}, {'name': 'ssl:connect/4'}]}] Added Description The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and 11.2.12.11. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-757 Added Reference https://cna.erlef.org/cves/CVE-2026-55953.html Added Reference https://github.com/erlang/otp/commit/064e236414614f9085cbbbd6eacf0e43c02d1b4b Added Reference https://github.com/erlang/otp/commit/0a82596d425abe43dc2e0b3d74aa1557ef74051c Added Reference https://github.com/erlang/otp/commit/e6ff938116b2872bccc478af7fefb56627285b77 Added Reference https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882 Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-55953 Added Reference https://www.erlang.org/doc/system/versions.html#order-of-versions