Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtlspacketdemux module) allows an unauthenticated remote…
CVE-2026-55950
Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtlspacketdemux module) allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP datagrams to the correct connection handler. When a DTLS client reconnects rapidly from the same source address and port (sending multiple ClientHello messages in quick succession), a race condition in the demux's internal gbtrees key-value store causes a {keyexists, {old, Client}} crash, terminating the demux process. Because the demux is shared across all DTLS associations on that listener, its crash immediately kills every active DTLS session, not just the attacker's. The attack is pre-authentication: the attacker only needs to send UDP datagrams containing valid ClientHello messages from the same source IP and port before the intermediate DOWN monitor message is processed by the genserver. No credentials, no completed handshake, and no special configuration are required, and the crash can be repeated indefinitely to create a persistent denial of service for all clients of that…
Assessment
- CVSS
- 8.7 (v4.0)
- Severity
- High
- EPSS
- 0.38% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 2 July 2026
- Last updated
- 11 November 2026
- Assigner
- EEF
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
At the source
References
- https://github.com/erlang/otp/security/advisories/GHSA-hwfc-5hf4-gvr3
- https://cna.erlef.org/cves/CVE-2026-55950.html
- https://osv.dev/vulnerability/EEF-CVE-2026-55950
- https://www.erlang.org/doc/system/versions.html#order-of-versions
- https://github.com/erlang/otp/commit/44dcb4c3d900777493ce2a6129f451aa475811f9
- https://github.com/erlang/otp/commit/e44d2bf01c4473ef2ea7f09e3523cf96de6e4a04
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-55950