CVE-2026-54887

Executive Summary

CVE-2026-54887 is a use of default cryptographic key vulnerability in Erlang/OTP's DTLS server implementation, specifically within the dtls_server_connection:initial_hello/3 routine. During the server startup window (0-15 seconds), the previous_cookie_secret is initialized to an empty binary (<<>>) rather than a cryptographically random value, allowing any attacker who observes the plaintext ClientHello to predictably compute a valid DTLS cookie. This bypass of the RFC 6347 §4.2.1 source address verification mechanism enables reflection/amplification attacks and state-exhaustion denial-of-service against vulnerable servers. All Erlang/OTP deployments running DTLS servers (e.g., VoIP, IoT telemetry, secure messaging) in version ranges OTP 20.0 through 29.0.2 are affected; a patched version is available.

Technical Analysis

The vulnerability resides in lib/ssl/src/dtls_server_connection.erl in the initial_hello/3 function. When a DTLS server process first starts, the function initializes the previous_cookie_secret to the empty binary (<<>>) instead of generating a random value using crypto:strong_rand_bytes/1 or equivalent. The DTLS cookie mechanism is defined by RFC 6347 Section 4.2.1 as a stateless handshake validation: the server sends a HelloVerifyRequest containing a cookie, and the client must echo it back. The cookie is computed as:

cookie = HMAC(secret, ClientHello || IP || Port)

With secret = <<>>, the HMAC becomes deterministic — HMAC(<<>>, data) is a well-defined standard value (RFC 2104 specifies the behavior of an empty key). Any attacker who can sniff or observe the initial plaintext ClientHello can compute:

predicted_cookie = dtls_handshake:cookie(<<>>, ClientIP, ClientPort, ClientHello)

and immediately forge a valid cookie response, bypassing the server's source-address verification. Critically, this is not an authentication failure — DTLS cookies are a denial-of-service mitigation, not a credential check. The impact is therefore two-fold:

1. Amplification: An attacker can spoof source IP addresses during the startup window. Each spoofed ClientHello forces the server to allocate state and perform expensive cryptographic operations (ECDHE key generation, certificate processing) before the cookie check is reached. Because the attacker can trivially pass the cookie check, the server proceeds to full handshake processing for each spoofed source.

2. State exhaustion: The server maintains handshake state for each validated cookie, leading to memory and file-descriptor exhaustion. With multiple spoofed connection attempts during the 15-second window, an attacker can consume substantial server resources.

The window is bounded: after the first secret rotation (which occurs after 0-15 seconds), the cookie secret is randomized, making prediction infeasible. However, the attacker can repeatedly trigger new server instances (e.g., via service restarts triggered by load balancer health checks, or by targeting multiple instances in a cluster) to re-enter the vulnerable window.

Attack surface includes any publicly accessible DTLS server (UDP port 4433 typical for Erlang DTLS, though configurable). This affects:

• VoIP/SIP servers using DTLS-SRTP
• IoT device communication gateways using DTLS
• Secure messaging applications using Erlang's ssl application with DTLS
• Any microservice using dtls_listen with default configuration

The affected version ranges are:

• OTP 29.0.0 to 29.0.2 (ssl ≤ 11.7.2)
• OTP 28.5.0 to 28.5.0.2 (ssl ≤ 11.6.0.2)
• OTP 27.3.4 to 27.3.4.13 (ssl ≤ 11.2.12.9)
• All OTP versions from 20.0 to 28.4.x (ssl 8.2 to 11.2.x)

Exploitation Scenarios

Scenario: Reflective Amplification Attack Against a Public DTLS Endpoint

Step 1 — Reconnaissance: The attacker scans for UDP port 4433 (or other configured DTLS ports) using nmap or a custom UDP probe:

nmap -sU -p 4433 --open target_ip_range

The attacker sends a single UDP packet containing a DTLS ClientHello to a non-existent port to confirm a UDP response (HelloVerifyRequest) — the presence of a DTLS response confirms an Erlang DTLS server. Alternatively, service banner detection via a crafted DTLS record.

Step 2 — Weaponization: The attacker crafts a malicious DTLS ClientHello. The attacker needs:

• Target server IP and port
• A spoofed source IP (the victim) that they control from a UDP spoofing-capable host

# Python-like pseudocode for crafting the attack
client_hello = construct_dtls_clienthello(
    protocol_version=DTLS 1.2,
    random=get_random_bytes(32),
    cipher_suites=[TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256],
    extensions=[...]
)

# Send the ClientHello with spoofed source IP
send_udp_packet(
    src_ip=VICTIM_IP,
    dst_ip=TARGET_SERVER,
    dst_port=4433,
    payload=client_hello
)

The attacker uses a raw socket or a tool like scapy to spoof the source IP. The IP spoofing is critical — the server will generate a cookie bound to the spoofed IP and port.

Step 3 — Cookie Prediction: The attacker sniffs the network or captures the wire traffic to obtain the server's HelloVerifyRequest response. However, because the cookie secret is empty, the attacker does not even need to see the response — they can predict it:

cookie = HMAC_SHA256(
    key=<<>>,  # empty key
    data=client_hello_bytes || VICTIM_IP || VICTIM_PORT
)

The attacker computes this offline immediately after sending the spoofed ClientHello. No response observation is strictly required (though it helps confirm the server is up and the handshake is progressing).

Step 4 — Execution — Handshake Amplification: The attacker sends the forged ClientHello with the predicted cookie:

send_udp_packet(
    src_ip=VICTIM_IP,
    dst_ip=TARGET_SERVER,
    dst_port=4433,
    payload=client_hello_with_cookie
)

The server validates the cookie — it matches because the HMAC key is empty — and proceeds to full handshake processing: it allocates state, generates an ephemeral key pair (costly ECDHE operation), constructs a ServerHello and Certificate message (potentially large if the server uses a certificate chain), and sends the response back to the spoofed IP (the victim).

Step 5 — Post-Exploitation — Resource Exhaustion: The attacker repeats Steps 2-4 with different spoofed source IPs (a single /24 subnet provides 254 target IPs). Each iteration causes the server to:

• Allocate a new connection state record
• Generate ephemeral keys
• Process and send a multi-KB certificate message to a non-existent or non-responsive source

With a modest 1 Gbps UDP spoofing capability, the attacker can generate tens of thousands of spoofed ClientHellos per second, each triggering a server response of 2-5 KB (amplification factor of 10-20x when including certificate chains). This exhausts CPU and memory within seconds, causing denial-of-service to legitimate clients.

Post-exploitation: Because the attack window is only 15 seconds, the attacker must repeat the attack at intervals or trigger service restarts. If the server is behind an orchestrator that restarts unhealthy containers, the attacker can deliberately send malformed inputs to trigger a crash-loop, re-entering the vulnerable window each time a new DTLS listener initializes.

Impact Assessment

The CVSS score of 6.3 (Medium) reflects a confidentiality impact of None, but integrity and availability impacts of Low. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L indicates:

• Attack Vector: Network (remote, no physical access) — AV:N
• Attack Complexity: Low — the empty-key HMAC is trivially predictable; no special conditions beyond observing/sending a ClientHello — AC:L
• Privileges Required: None — PR:N
• User Interaction: None — UI:N

The real-world impact, however, is higher than the CVSS numerical score suggests for specific deployment scenarios:

Business Impact:

• Availability: The primary impact. A sustained attack can take a DTLS server offline for the duration of the startup window. For real-time communication services (VoIP, video conferencing), this is a direct loss of service revenue and SLAs.
• Integrity: Low — the attacker can only manipulate handshake state, not the encrypted datagrams themselves. However, a successful state-exhaustion attack effectively corrupts the server's ability to handle legitimate handshakes.
• Confidentiality: None directly — no data is exposed.

Affected Systems:

• All Erlang/OTP deployments with ssl application version 8.2 through 11.7.2 (including 11.6.0.2 and 11.2.12.9) using DTLS server functionality
• Specific sectors: telecom (VoIP/SIP trunks), IoT platform providers, financial messaging systems using secure datagram transport

Blast Radius: The vulnerability is remotely exploitable over the network. The EPSS score of 0.00243 (15.6th percentile) indicates a low probability of exploitation in the wild currently, but the low complexity combined with public PoC availability raises the risk profile. No CISA KEV listing exists.

CWE-1394 (Use of Default Cryptographic Key) means the vulnerability class is well-understood; security teams should treat this as a high-priority fix despite the moderate CVSS score because the attack requires only trivial tooling (scapy or raw sockets) and no prior access.

Detection Guidance

Sigma Rule

title: Erlang DTLS Server Cookie Bypass — UDP Flood on DTLS Port
id: 5e4b8f2a-9c31-4d6f-b8a5-3f8e1c7d2e4a
status: experimental
description: Detects UDP traffic patterns consistent with CVE-2026-54887 exploitation — high volume of DTLS ClientHello packets with spoofed source IPs targeting Erlang DTLS servers during startup.
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  category: network_connection
  product: zeek
detection:
  selection_dtls_alerts:
    - alert_id: "DTLS::HelloVerifyRequest"
  selection_port:
    destination.port: 4433
  selection_spoofed:
    - "src_ip not in known_server_ips"
    - "src_ip != initiator_ip"
  selection_volume:
    events_count: 100
    timeframe: 10 seconds
  condition: selection_dtls_alerts AND selection_port AND selection_spoofed AND selection_volume
falsepositives:
  - Legitimate load testing or network scanning tools generating UDP traffic
  - DTLS servers behind NAT with frequent IP changes
level: high
tags:
  - attack.resource_exploitation
  - attack.t1498
  - cve.2026.54887

YARA Rule

rule DTLS_Erlang_EmptyCookie_Exploit {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects DTLS ClientHello packets with forged cookie value consistent with CVE-2026-54887 empty HMAC key prediction"
        cve = "CVE-2026-54887"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54887"
    strings:
        $dtls_header = { 16 FE FF }        // Handshake record, DTLS 1.2 (0xFEFF)
        $client_hello = { 01 }              // ClientHello message type
        $empty_cookie_len = { 1C }          // Cookie length field = 0x1C (28 bytes, common hash output)
        $cookie_pattern = { 20 00 00 00 00 00 00 00 }  // Cookie data start (HMAC output, high entropy but predictable)
        $erlang_user_agent = "Erlang" ascii
    condition:
        uint16(0) == 0x16FE and
        $dtls_header at 0 and
        $client_hello in (0..5) and
        $empty_cookie_len and
        $cookie_pattern and
        filesize < 1500
}

Suricata IDS Rule

alert udp any any -> any 4433 (msg:"ET EXPLOIT Erlang DTLS CVE-2026-54887 Cookie Bypass Attempt"; flow:to_server; content:"|16 fe ff|"; depth:3; content:"|01|"; offset:13; depth:1; content:"|1c|"; distance:4; within:1; content:"|20|"; distance:0; within:1; reference:cve,2026-54887; classtype:attempted-dos; sid:202654887; rev:1;)

Explanation: The rule matches UDP packets to port 4433 containing a DTLS handshake record (0x16 0xFE 0xFF), followed by a ClientHello message type (0x01), a cookie length field of 0x1C (28 bytes — likely HMAC-SHA256 output), and a cookie value. Note: this requires the client to send a forged cookie in the ClientHello, which only occurs after the server sends HelloVerifyRequest. Combined with rate-based rules, this detects the amplification pattern.

Elastic Detection

// EQL rule for detecting DTLS amplification pattern
sequence with maxspan=10s
  [ network where
    event.category == "network" and
    network.protocol == "udp" and
    destination.port == 4433 and
    network.direction == "inbound" and
    source.ip != destination.ip
  ] with runs=10
  [ network where
    event.category == "network" and
    network.protocol == "udp" and
    source.port == 4433 and
    network.direction == "outbound" and
    network.bytes > 1000
  ]

Detection rationale: The EQL sequence identifies 10 or more inbound UDP packets to port 4433 from addresses different from the destination (indicating spoofed sources), followed by outbound responses larger than 1 KB (certificate chains). This captures the amplification loop.

Splunk SPL Query

index=netflow sourcetype=netflow_udp
| where dest_port=4433 AND protocol="udp"
| eventstats count(eval(src_ip != dest_ip)) as spoofed_count by dest_ip
| where spoofed_count > 50
| stats count by dest_ip, src_ip, _time
| eval threshold = 100
| where count > threshold
| table _time, dest_ip, src_ip, count
| sort - count

Detection rationale: This SPL query aggregates inbound UDP traffic to port 4433 over a time window, flags cases where the source IP count exceeds 100 distinct addresses (indicating spoofing), and groups by destination IP to identify servers under active attack.

Wazuh OSSEC Rule

<group name="cve-2026-54887,">
  <rule id="548870" level="12">
    <decoded_as>json</decoded_as>
    <field name="dest_port">^4433$</field>
    <field name="protocol">^udp$</field>
    <field name="event_type">^flow$</field>
    <description>DTLS Amplification Attempt - Port 4433 UDP traffic anomaly</description>
    <group>network_attack,</group>
    <alert>
      <data>
        <source>Network Alert</source>
        <details>High volume UDP traffic to DTLS port from multiple source IPs.</details>
        <cve>CVE-2026-54887</cve>
        <action>investigate</action>
      </data>
    </alert>
    <options>no_full_log</options>
  </rule>

  <rule id="548871" level="15" frequency="50" timeframe="60">
    <if_matched_sid>548870</if_matched_sid>
    <description>Repeated DTLS amplification events - CVE-2026-54887 exploitation</description>
    <group>network_attack,erlang,dtls</group>
  </rule>
</group>

Note: This Wazuh rule relies on a JSON decoder for network flow data. Ensure the Wazuh manager has the appropriate decoder configured for netflow or suricata alerts feeding port 4433 UDP traffic.

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED (single source, OSV, not independently confirmed).

Immediate Mitigations:

1. Upgrade Erlang/OTP to a patched version as the primary action:

   • OTP 29.0.3 (ssl 11.7.3)
   • OTP 28.5.0.3 (ssl 11.6.0.3)
   • OTP 27.3.4.14 (ssl 11.2.12.10)

   For OTP versions below 27.3.4, upgrade to the latest patch of the nearest supported line (27.3.x or 28.5.x). If using package managers:

   • Debian/Ubuntu: apt update && apt install erlang-ssl (after adding the Erlang Solutions repo)
   • RHEL/CentOS: dnf update erlang
   • From source (Erlang Solutions or OTP GitHub): git clone https://github.com/erlang/otp && git checkout OTP-29.0.3 && ./otp_build setup
   • Docker: docker pull erlang:29.0.3

2. If immediate upgrade is not possible, apply network-level mitigations:

   • Rate-limit UDP packets to the DTLS port at the firewall/load balancer: iptables -A INPUT -p udp --dport 4433 -m limit --limit 100/s -j ACCEPT (adjust to legitimate traffic baseline).
   • Deploy a UDP proxy (e.g., udpproxy or application-level LB) in front of the DTLS listener that performs source-IP validation before forwarding to the Erlang node.
   • Enable source-IP filtering on the edge firewall to drop packets with spoofed source IPs (BCP 38 / RFC 2827 filtering) — this is the most effective immediate mitigation against the amplification vector.

3. Restrict access: If the DTLS service is not required for public access, limit the listener to trusted IP ranges via ssl:dtls_listen configuration options ({ip, {127,0,0,1}} or a private subnet).

Long-Term Hardening:

1. Monitor startup windows: Implement monitoring that flags DTLS server restarts and checks for abnormal traffic within the first 15 seconds after each restart.
2. Apply NTP/patch discipline: Treat Erlang/OTP as a security-critical dependency; subscribe to Erlang security announcements and apply patches within 7 days of release.
3. Harden cookie secret generation: If you maintain a fork or vendored copy of dtls_server_connection.erl, ensure initial_hello/3 calls crypto:strong_rand_bytes(32) to initialize both the current and previous cookie secrets.
4. Enable BCP 38 filtering at all network egress/ingress points to reduce the viability of IP spoofing — the core enabler of this attack.

Post-Patch Validation: After upgrading, verify the cookie secret is no longer empty:

% Check that initial_hello/3 initializes with random bytes
{ok, _} = application:ensure_all_started(ssl),
{ok, ListenSocket} = ssl:dtls_listen(4433, [{protocol, dtls}]),
% Trigger a ClientHello and observe the HelloVerifyRequest cookie
% Then verify the cookie is NOT predictable from the empty key

Additionally, run the upstream regression tests for dtls_server_connection to confirm correct initialization.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54887
2. Erlang/OTP GitHub Release Notes (OTP 29.0.3): https://github.com/erlang/otp/releases/tag/OTP-29.0.3
3. RFC 6347 — Datagram Transport Layer Security Version 1.2: https://datatracker.ietf.org/doc/html/rfc6347
4. CWE-1394 — Use of Default Cryptographic Key: https://cwe.mitre.org/data/definitions/1394.html

No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this vulnerability as of this writing. The public PoC and EPSS score of 0.00243 indicate theoretical exploitability without confirmed active exploitation. However, the trivial nature of the attack (raw socket UDP spoofing plus computed HMAC with an empty key) warrants immediate patching despite the low observed exploitation rate.