Executive brief
A vulnerability in the Erlang/OTP SSL library affects how secure connections are established using the DTLS protocol. During a brief window after a server starts up, a security feature designed to prevent denial-of-service attacks can be bypassed. This allows an attacker to perform resource-intensive operations on the server using spoofed identities, potentially leading to service degradation or outages.
Technical details
A 'Use of Default Cryptographic Key' vulnerability (CWE-1394) exists in the Erlang/OTP ssl library's DTLS server implementation. During the initial startup window (approximately 0-15 seconds), the 'previous_cookie_secret' is initialized to an empty binary (<<>>) in 'dtls_server_connection:initial_hello/3'. Because HMAC with an empty key is deterministic, an attacker observing a plaintext ClientHello can compute a valid DTLS cookie. This allows the attacker to bypass source address verification (RFC 6347), enabling DTLS handshake amplification attacks using spoofed source IP addresses. The issue is resolved in OTP versions 29.0.3, 28.5.0.3, and 27.3.4.14.
Affected products
- Erlang OTP 20.0 to 27.3.4.13, 28.0 to 28.5.0.2, 29.0 to 29.0.2
- Erlang ssl 8.2 to 11.2.12.9, 11.3 to 11.6.0.2, 11.7 to 11.7.2
Timeline
- 2026-07-02: advisory
- 2026-07-02: disclosed