6.3

CVE-2026-54887: erlang erlang\/otp Use of Default Cryptographic Key

CVSS: 6.3v4.0MediumModified
AliasesUBUNTU-CVE-2026-54887DEBIAN-CVE-2026-54887
Published 02-07-2026Last modified 24-07-2026
Open JSON

Vulnerability summary

CVE-2026-54887 is a medium (CVSS 6.3) Use of Default Cryptographic Key vulnerability in erlang erlang\/otp. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.4% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.3/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 5
OPENSUSE-SU-2026:11559-1OPENSUSE-SU-2026:11560-1SUSE-SU-2026:3579-1SUSE-SU-2026:3645-1USN-8901-1

Timeline

  1. 02-07-2026
    PublishedVulnerability first disclosed.
  2. 24-07-2026
    Last modifiedVulnerability information updated.

Description

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 §4.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext ClientHello can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses. This vulnerability is associated with program file lib/ssl/src/dtls_server_connection.erl and program routine dtls_server_connection:initial_hello/3. This issue affects OTP from OTP 20.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssl from 8.2 before 11.7.3, 11.6.0.3 and 11.2.12.10.

CVSS metrics

6 scores · 4 sources · 2 versions

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Erlang3 products
  • erlang\/otp≥ 20.0, < 27.3.4.14 | ≥ 28.0, < 28.5.0.3 | ≥ 29.0, < 29.0.3
  • erlang\/ssl≥ 8.2, < 11.2.12.10 | ≥ 11.3, < 11.6.0.3 | ≥ 11.7, < 11.7.3
  • otp≥ 8.2 (No fix recorded) | ≥ 20.0 (No fix recorded) | ≥ e594aad2f87aab39e99fccf9e021bc94e0bbf7d4, < 888e3bcd72d5406016b9e0de741026bc2a6f114d
Debian1 product
  • erlangAll versions (No fix recorded) | < 1:27.3.4.1+dfsg-1+deb13u3 | < 1:29.0.3+dfsg-1
Ubuntu1 product
  • erlang< 1:20.2.2+dfsg-1ubuntu2+esm4 | < 1:22.2.7+dfsg-1ubuntu0.5+esm3 | < 1:24.2.1+dfsg-1ubuntu0.8 | < 1:25.3.2.8+dfsg-1ubuntu4.8 | All versions (No fix recorded) | < 1:27.3.4.6+dfsg-1ubuntu0.2

3 vendors · 5 products

References

10 links