Quick answers
- Is CVE-2026-55950 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55950 being exploited in the wild.
- How severe is CVE-2026-55950?
- Informational severity, with a CVSS score of 8.7, published 2 July 2026.
- Which products and versions are affected?
- Erlang OTP 25.3 to 27.3.4.13, 28.0 to 28.5.0.2, 29.0 to 29.0.2; Erlang ssl 10.9 to 11.2.12.9, 11.3 to 11.6.0.2, 11.7 to 11.7.2.
- Is there a fix for CVE-2026-55950?
- A patch was published on 2026-07-02. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-55950 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-55950?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Time-of-check Time-of-use (TOCTOU) race condition exists in the 'dtls_packet_demux' module of the Erlang/OTP 'ssl' application. The vulnerability is triggered when a remote attacker sends multiple DTLS ClientHello messages in rapid succession from the same source IP and port. This causes a race condition in the internal 'gb_trees' key-value store, leading to a '{key_exists, {old, Client}}' error that crashes the gen_server process. Because this process is shared across all DTLS associations on a listener, the crash terminates all active sessions. The issue is fixed by replacing 'gb_trees:insert/3' with 'gb_trees:enter/3' in the affected module.
Affected products
- Erlang OTP 25.3 to 27.3.4.13, 28.0 to 28.5.0.2, 29.0 to 29.0.2
- Erlang ssl 10.9 to 11.2.12.9, 11.3 to 11.6.0.2, 11.7 to 11.7.2
Timeline
- 2026-07-02: advisory
- 2026-07-02: disclosed
- 2026-07-02: patched