# CVE-2026-55950: Erlang OTP race condition in dtls_packet_demux

Source: https://junglewise.ai/threats/cve-2026-55950-erlang-otp-race-condition-in-dtls-packet-demux  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-55950 · Severity: info · CVSS 8.7 · Published 2026-07-02

A vulnerability in the Erlang/OTP networking library could allow an unauthenticated remote attacker to crash all active encrypted connections on a server. By sending a rapid sequence of connection requests, an attacker can trigger a software error that shuts down the component responsible for routing traffic. This results in a complete denial of service for all users currently connected to the affected service.

## Quick answers

**Is CVE-2026-55950 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55950 being exploited in the wild.

**How severe is CVE-2026-55950?** Informational severity, with a CVSS score of 8.7, published 2 July 2026.

**Which products and versions are affected?** Erlang OTP 25.3 to 27.3.4.13, 28.0 to 28.5.0.2, 29.0 to 29.0.2; Erlang ssl 10.9 to 11.2.12.9, 11.3 to 11.6.0.2, 11.7 to 11.7.2.

**Is there a fix for CVE-2026-55950?** A patch was published on 2026-07-02. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55950 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55950?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Time-of-check Time-of-use (TOCTOU) race condition exists in the 'dtls_packet_demux' module of the Erlang/OTP 'ssl' application. The vulnerability is triggered when a remote attacker sends multiple DTLS ClientHello messages in rapid succession from the same source IP and port. This causes a race condition in the internal 'gb_trees' key-value store, leading to a '{key_exists, {old, Client}}' error that crashes the gen_server process. Because this process is shared across all DTLS associations on a listener, the crash terminates all active sessions. The issue is fixed by replacing 'gb_trees:insert/3' with 'gb_trees:enter/3' in the affected module.

## Affected products

- Erlang OTP 25.3 to 27.3.4.13, 28.0 to 28.5.0.2, 29.0 to 29.0.2
- Erlang ssl 10.9 to 11.2.12.9, 11.3 to 11.6.0.2, 11.7 to 11.7.2

## Timeline

- 2026-07-02: advisory
- 2026-07-02: disclosed
- 2026-07-02: patched

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-55950.html](https://cna.erlef.org/cves/CVE-2026-55950.html)
- [https://github.com/erlang/otp/commit/e44d2bf01c4473ef2ea7f09e3523cf96de6e4a04](https://github.com/erlang/otp/commit/e44d2bf01c4473ef2ea7f09e3523cf96de6e4a04)
- [https://github.com/erlang/otp/security/advisories/GHSA-hwfc-5hf4-gvr3](https://github.com/erlang/otp/security/advisories/GHSA-hwfc-5hf4-gvr3)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)