Executive brief
A vulnerability in the Erlang/OTP networking library could allow an unauthenticated remote attacker to crash all active encrypted connections on a server. By sending a rapid sequence of connection requests, an attacker can trigger a software error that shuts down the component responsible for routing traffic. This results in a complete denial of service for all users currently connected to the affected service.
Technical details
A Time-of-check Time-of-use (TOCTOU) race condition exists in the 'dtls_packet_demux' module of the Erlang/OTP 'ssl' application. The vulnerability is triggered when a remote attacker sends multiple DTLS ClientHello messages in rapid succession from the same source IP and port. This causes a race condition in the internal 'gb_trees' key-value store, leading to a '{key_exists, {old, Client}}' error that crashes the gen_server process. Because this process is shared across all DTLS associations on a listener, the crash terminates all active sessions. The issue is fixed by replacing 'gb_trees:insert/3' with 'gb_trees:enter/3' in the affected module.
Affected products
- Erlang OTP 25.3 to 27.3.4.13, 28.0 to 28.5.0.2, 29.0 to 29.0.2
- Erlang ssl 10.9 to 11.2.12.9, 11.3 to 11.6.0.2, 11.7 to 11.7.2
Timeline
- 2026-07-02: advisory
- 2026-07-02: disclosed
- 2026-07-02: patched