# CVE-2026-54887: Erlang OTP predictable DTLS cookie computation in ssl library

Source: https://junglewise.ai/threats/cve-2026-54887-erlang-otp-predictable-dtls-cookie-computation-in-ssl-library  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-54887 · Severity: info · CVSS 6.3 · Published 2026-07-02

A vulnerability in the Erlang/OTP SSL library affects how secure connections are established using the DTLS protocol. During a brief window after a server starts up, a security feature designed to prevent denial-of-service attacks can be bypassed. This allows an attacker to perform resource-intensive operations on the server using spoofed identities, potentially leading to service degradation or outages.

## Quick answers

**Is CVE-2026-54887 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54887 being exploited in the wild.

**How severe is CVE-2026-54887?** Informational severity, with a CVSS score of 6.3, published 2 July 2026.

**Which products and versions are affected?** Erlang OTP 20.0 to 27.3.4.13, 28.0 to 28.5.0.2, 29.0 to 29.0.2; Erlang ssl 8.2 to 11.2.12.9, 11.3 to 11.6.0.2, 11.7 to 11.7.2.

**Is there a fix for CVE-2026-54887?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54887 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54887?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A 'Use of Default Cryptographic Key' vulnerability (CWE-1394) exists in the Erlang/OTP ssl library's DTLS server implementation. During the initial startup window (approximately 0-15 seconds), the 'previous_cookie_secret' is initialized to an empty binary (<<>>) in 'dtls_server_connection:initial_hello/3'. Because HMAC with an empty key is deterministic, an attacker observing a plaintext ClientHello can compute a valid DTLS cookie. This allows the attacker to bypass source address verification (RFC 6347), enabling DTLS handshake amplification attacks using spoofed source IP addresses. The issue is resolved in OTP versions 29.0.3, 28.5.0.3, and 27.3.4.14.

## Affected products

- Erlang OTP 20.0 to 27.3.4.13, 28.0 to 28.5.0.2, 29.0 to 29.0.2
- Erlang ssl 8.2 to 11.2.12.9, 11.3 to 11.6.0.2, 11.7 to 11.7.2

## Timeline

- 2026-07-02: advisory
- 2026-07-02: disclosed

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-54887.html](https://cna.erlef.org/cves/CVE-2026-54887.html)
- [https://github.com/erlang/otp/commit/888e3bcd72d5406016b9e0de741026bc2a6f114d](https://github.com/erlang/otp/commit/888e3bcd72d5406016b9e0de741026bc2a6f114d)
- [https://github.com/erlang/otp/security/advisories/GHSA-p2m2-3c2w-8jp8](https://github.com/erlang/otp/security/advisories/GHSA-p2m2-3c2w-8jp8)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)