CVE-2026-55953: Erlang/OTP SSL Auth Bypass Vulnerability

CVE-2026-55953 Overview

CVE-2026-55953 is a certificate validation bypass in the Erlang/OTP ssl module affecting TLS 1.2, earlier TLS versions, and DTLS clients. The client fails to verify that the cipher suite selected by the server in ServerHello was among the suites offered in ClientHello. An on-path attacker can force selection of an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_*, which requires no server certificate. This bypasses verify_peer, cacerts, and hostname checks entirely, allowing full interception of subsequent application traffic. The TLS 1.3 client path is not affected because it performs this validation per RFC 8446.

Critical Impact
On-path attackers can transparently downgrade Erlang/OTP TLS 1.2 and DTLS clients to unauthenticated anonymous cipher suites, defeating certificate validation and enabling full man-in-the-middle interception.

Affected Products

Erlang/OTP versions from OTP 17.0 up to (but not including) OTP 29.0.4
Erlang/OTP 28.5.0.4 and OTP 27.3.4.15 branches
ssl application from 5.3.4 before 11.7.4, 11.6.0.4, and 11.2.12.11

Discovery Timeline

2026-07-27 - CVE-2026-55953 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-55953

Vulnerability Analysis

The flaw resides in the pre-TLS 1.3 client handshake path within lib/ssl/src/ssl_handshake.erl. The tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel, then passes the server-selected cipher suite directly to ssl_handshake:handle_server_hello_extensions/9. That function installs the cipher suite without confirming it was present in the client's advertised list. This is classified under [CWE-757] (Selection of Less-Secure Algorithm During Negotiation). Because anonymous key exchange suites do not require a certificate, the handshake completes with attacker-controlled ephemeral parameters and ssl:connect returns {ok, Socket} as if the peer were legitimate.

Root Cause

The client-side hello handler performs no membership check between the server-chosen CipherSuite and the suites configured via the ciphers option. Consequently, a server can select any suite from the full TLS registry, including anonymous variants that skip certificate authentication.

Attack Vector

An attacker positioned on the network path between the Erlang client and the intended server intercepts the ClientHello. The attacker responds with a ServerHello selecting TLS_DH_anon_WITH_AES_128_CBC_SHA or a similar anonymous suite. The client accepts the choice, no certificate is presented or validated, no hostname is checked, and all subsequent traffic is readable and modifiable by the attacker.

text

// Security patch in lib/ssl/src/ssl_handshake.erl
// Adds pre-TLS 1.3 client cipher suite membership check
                                Exts, Version,
                                SslOpts,
                                ConnectionStates0, Renegotiation, IsNew) ->
+    AvailableCipherSuites = available_suites(maps:get(ciphers, SslOpts), Version),
+    validate_cipher_suite(CipherSuite, AvailableCipherSuites),
     ConnectionStates = handle_renegotiation_extension(client, RecordCB, Version,
                                                       maps:get(renegotiation_info, Exts, undefined),
                                                       Random,

Source: Erlang/OTP commit 064e2364. The patch computes AvailableCipherSuites from the client's configured ciphers option and calls validate_cipher_suite/2 to reject any server selection not in that list.

Detection Methods for CVE-2026-55953

Indicators of Compromise

TLS sessions negotiated by Erlang/OTP clients using anonymous cipher suites such as TLS_DH_anon_* or TLS_ECDH_anon_* where the application was configured with verify_peer.
Successful ssl:connect returns to hosts whose certificates have never been logged in expected certificate transparency records.
Unexpected absence of Certificate handshake messages in packet captures from Erlang-based clients.

Detection Strategies

Capture TLS handshakes at network egress points and alert on ServerHello responses that select anonymous key exchange suites, particularly toward external services.
Audit Erlang/OTP application versions across the fleet and flag deployments running ssl versions earlier than 11.7.4, 11.6.0.4, or 11.2.12.11.
Correlate outbound TLS 1.2 sessions from Erlang runtimes with the client's intended cipher list to identify mismatches.

Monitoring Recommendations

Enable TLS metadata logging in reverse proxies and load balancers fronting Erlang services, capturing negotiated protocol version and cipher suite.
Monitor for changes in cipher suite distribution across BEAM-based services, which commonly indicate downgrade activity.
Ingest handshake telemetry into a SIEM or data lake and build alerts on any observed anonymous suite negotiation.

How to Mitigate CVE-2026-55953

Immediate Actions Required

Upgrade Erlang/OTP to 29.0.4, 28.5.0.4, or 27.3.4.15 (or the corresponding ssl versions 11.7.4, 11.6.0.4, or 11.2.12.11).
Restrict the ciphers option in ssl:connect/2,3 calls to an explicit allow-list that excludes all anonymous suites.
Inventory all applications embedding Erlang/OTP, including Elixir, RabbitMQ, and CouchDB deployments, and identify vulnerable runtimes.

Patch Information

The fix adds an explicit cipher suite membership check to the pre-TLS 1.3 client handshake handler. Details are available in the Erlang/OTP GitHub Security Advisory GHSA-c6cw-pr89-w882 and the CNA advisory from the Erlang Ecosystem Foundation. Corresponding commits are 064e2364, 0a82596d, and e6ff9381.

Workarounds

Configure clients to require TLS 1.3 only via versions => ['tlsv1.3'], which uses the unaffected handshake path.
Explicitly enumerate acceptable cipher suites in the ciphers client option and omit any suite whose name contains anon.
Terminate outbound TLS through a hardened proxy that enforces cipher suite policy independently of the Erlang client.

bash

# Example: restrict Erlang ssl:connect to TLS 1.3 and named suites
ssl:connect("example.com", 443, [
    {verify, verify_peer},
    {cacerts, public_key:cacerts_get()},
    {versions, ['tlsv1.3']},
    {ciphers, [
        #{key_exchange => any, cipher => aes_256_gcm, mac => aead, prf => sha384},
        #{key_exchange => any, cipher => aes_128_gcm, mac => aead, prf => sha256}
    ]},
    {server_name_indication, "example.com"}
]).