UpHeron
All vulnerabilities

Servers and applications

CVE-2026-55953

The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to…

Severity
Critical 9.1
Published
27 Jul 2026
Last changed
8 Sept 2026
Added to UpHeron
16 Oct 2026
Fixed in
27.3.4.15, 28.5.0.4, 29.0.4
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 17.0 before 27.3.4.15
  • From 28.0 before 28.5.0.4
  • From 29.0 before 29.0.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-55953
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-55953