CVE-2026-55953: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-55953 is a TLS/DTLS cipher suite validation bypass vulnerability in Erlang/OTP's SSL client implementation, classified as "(D)TLS-1.2 Server Cert Verification Bypass via Unoffered Anonymous Cipher Suite." It affects Erlang/OTP from R13B03 (OTP 17.0) before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4 — corresponding to ssl library versions 5.3.4 through 11.7.3. The vulnerability was published on July 27, 2026, with patches released shortly after. It carries a CVSS v3.1 score of 7.4 (High) and a CVSS v4.0 score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause is CWE-757 (Selection of Less-Secure Algorithm During Negotiation / Algorithm Downgrade): the tls_handshake:hello/5 handler in the TLS 1.2 (and earlier) and DTLS client validates the negotiated protocol version and downgrade sentinel, but passes the server-chosen cipher suite directly to ssl_handshake:handle_server_hello_extensions/9 without checking whether that suite was among those offered by the client in ClientHello. The fix adds a validate_cipher_suite/2 function that performs a membership check (lists:member/2) and throws a fatal ILLEGAL_PARAMETER alert if the server-selected suite was not offered (GitHub Commit). An on-path attacker exploits this by intercepting the TLS handshake and responding with a ServerHello that selects an anonymous key exchange suite (e.g., TLS_DH_anon_* or TLS_ECDH_anon_*) — suites that require no server certificate — thereby bypassing verify_peer, cacerts, and hostname verification entirely. TLS 1.3 is not affected because it already performs this check per RFC 8446 (GitHub Advisory).

A successful exploit allows an unauthenticated on-path attacker to silently intercept and modify all application-layer traffic between the Erlang/OTP TLS client and its intended server, with high confidentiality and integrity impact and no availability impact. Because certificate validation and hostname checking are completely bypassed, the attacker can impersonate any server without possessing a trusted certificate, and ssl:connect returns {ok, Socket} as if the connection were legitimate. Any application relying on Erlang/OTP's TLS stack for secure communications — including RabbitMQ, Elixir applications, and other BEAM-based services — is at risk of credential theft, session hijacking, or data manipulation (GitHub Advisory, Feedly).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.245%, reflecting low current exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, as it requires an attacker to be positioned on-path between the client and server. No threat actor attribution or CISA KEV catalog listing has been reported at this time.

1. Positioning: Gain a network on-path (man-in-the-middle) position between the target Erlang/OTP TLS client and its intended server — for example, via ARP spoofing, DNS poisoning, BGP hijacking, or a rogue Wi-Fi access point.
2. Intercept ClientHello: Capture the TLS ClientHello message sent by the vulnerable Erlang/OTP client, noting the offered cipher suites and supported versions (TLS 1.2 or earlier / DTLS).
3. Craft malicious ServerHello: Respond to the client with a forged ServerHello message that selects an anonymous key exchange cipher suite (e.g., TLS_ECDH_anon_WITH_AES_128_CBC_SHA or TLS_DH_anon_WITH_AES_256_CBC_SHA) that was NOT included in the client's ClientHello offer.
4. Complete handshake without certificate: Because anonymous suites require no server certificate, complete the TLS handshake using attacker-controlled ephemeral key material. The vulnerable client's ssl_handshake:handle_server_hello_extensions/9 installs the suite without a membership check, so ssl:connect returns {ok, Socket} with no error.
5. Intercept and manipulate traffic: With the TLS session established through the attacker's ephemeral keys, decrypt, read, and optionally modify all subsequent application-layer traffic before forwarding (or not) to the real server (GitHub Advisory, GitHub Commit).

• Network: TLS ServerHello messages observed on the wire advertising anonymous cipher suites (e.g., TLS_DH_anon_*, TLS_ECDH_anon_*) in response to Erlang/OTP client connections; unexpected TLS session establishment with no certificate exchange captured in packet captures.
• Logs: Absence of certificate validation errors or hostname mismatch warnings in Erlang/OTP SSL logs despite connecting to an untrusted or unexpected endpoint; ssl:connect returning {ok, Socket} for connections that should have failed certificate verification.
• Network: Unusual intermediate hosts appearing in network flow data between Erlang/OTP clients and their expected servers; ARP table anomalies or duplicate MAC addresses on the local network segment suggesting ARP spoofing.
• Application: Unexpected data corruption, session token theft, or credential reuse observed in applications built on Erlang/OTP (e.g., RabbitMQ, Elixir services) that communicate over TLS 1.2 or DTLS.

Upgrade Erlang/OTP to one of the patched versions: OTP 27.3.4.15 (for the OTP 17.0–27.x branch), OTP 28.5.0.4 (for the 28.x branch), or OTP 29.0.4 (for the 29.x branch), corresponding to ssl library versions 11.2.12.11, 11.6.0.4, and 11.7.4 respectively (GitHub Advisory). As an immediate workaround, configure applications to use TLS 1.3 exclusively, as the TLS 1.3 client path already performs cipher suite validation and is not affected. Additionally, deploy network controls (VPNs, network segmentation, 802.1X port authentication) to prevent on-path attacker positioning, and explicitly disable anonymous cipher suites at the application level in SSL options where possible.

The vulnerability was responsibly disclosed by Jonatan Männchen (GitHub: maennchen) and remediated by Ingela Andín (IngelaAndin) of the Erlang/OTP team (GitHub Advisory). Security news outlets including SecurityOnline.info covered the disclosure alongside other Erlang/OTP vulnerabilities. Fedora Linux issued updates for affected Erlang packages, and Linux security outlets reported on the Fedora advisory (Linux Security). Tenable released multiple Nessus detection plugins (IDs 330402, 331349, 333501, 333508) shortly after disclosure, indicating prompt uptake by the vulnerability management community.