TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
Summary
| CVE | CVE-2026-55953 |
|---|---|
| State | PUBLISHED |
| Assigner | EEF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-27 16:17:49 UTC |
| Updated | 2026-08-10 17:21:18 UTC |
| Description | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected. An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from OTP R13B03 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl from 3.10.7 before 11.2.12.11, from 11.3 before 11.6.0.4, and from 11.7 before 11.7.4. Whether OTP before OTP R13B03, corresponding to ssl before 3.10.7, is affected is unknown. |
Risk And Classification
Primary CVSS: v4.0 9.1 CRITICAL from 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002450000 probability, percentile 0.157040000 (date 2026-08-05)
Problem Types: CWE-757 | CWE-757 CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | Secondary | 9.1 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 9.1 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
PresentPrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Erlang | Erlang/otp | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Erlang | OTP | unknown R13B03 otp | Not specified |
| CNA | Erlang | OTP | affected R13B03 27.3.4.15 otp | Not specified |
| CNA | Erlang | OTP | affected 28.0 28.5.0.4 otp | Not specified |
| CNA | Erlang | OTP | affected 29.0 29.0.4 otp | Not specified |
| CNA | Erlang | OTP | unknown 3.10.7 otp | Not specified |
| CNA | Erlang | OTP | affected 3.10.7 11.2.12.11 otp | Not specified |
| CNA | Erlang | OTP | affected 11.3 11.6.0.4 otp | Not specified |
| CNA | Erlang | OTP | affected 11.7 11.7.4 otp | Not specified |
| CNA | Erlang | OTP | affected 84adefa331c4159d432d22840663c38f155cd4c1 * git | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/erlang/otp/commit/0a82596d425abe43dc2e0b3d74aa1557ef74051c | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | github.com | Patch |
| github.com/erlang/otp/commit/064e236414614f9085cbbbd6eacf0e43c02d1b4b | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | github.com | Patch |
| osv.dev/vulnerability/EEF-CVE-2026-55953 | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | osv.dev | Patch, Third Party Advisory |
| www.erlang.org/doc/system/versions.html | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | www.erlang.org | Release Notes |
| github.com/erlang/otp/commit/e6ff938116b2872bccc478af7fefb56627285b77 | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | github.com | Patch |
| github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882 | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | github.com | Vendor Advisory |
| cna.erlef.org/cves/CVE-2026-55953.html | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | cna.erlef.org | Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Jonatan Männchen / EEF (en)
CNA: Ingela Anderton Andin (en)
CNA: Jakub Witczak (en)
Additional Advisory Data
Workarounds
CNA: * Restrict client connections to TLS 1.3 only by setting versions to ['tlsv1.3'] in the client's ssl options. The TLS 1.3 client path performs the required cipher suite membership check and is not affected.
There are currently no legacy QID mappings associated with this CVE.