CVE-2026-55952

Executive Summary

CVE-2026-55952 is a high-severity (CVSS 8.2) denial-of-service vulnerability in the Erlang/OTP ssl application affecting TLS 1.3 session ticket handling. An unauthenticated remote attacker can send a single malformed ClientHello containing a pre-shared key extension with mismatched identity/binder list lengths, crashing the session ticket handler process and permanently disabling TLS 1.3 session ticket issuance on the affected listener until the ssl application restarts. All OTP releases from 22.2 up to (but not including) 29.0.3, 28.5.0.3, and 27.3.4.14 are affected, notably including the widely-deployed OTP 25.x and 26.x series, with TLS 1.2 connections remaining unaffected. The flaw stems from insufficient validation in tls_handshake_1_3:handle_pre_shared_key/3, where OfferedPreSharedKeys records with unequal identity and binder counts are forwarded unchecked to tls_server_session_ticket:use/4, which subsequently crashes.

Technical Analysis

The vulnerability resides in the Erlang/OTP ssl application's TLS 1.3 handshake state machine. Per RFC 8446 §4.2.11, the pre_shared_key extension within a ClientHello contains two lists that must be structurally consistent: the identities list (each containing a PSK identity and obfuscated_ticket_age) and the binders list (running PRF-HMAC over the full handshake transcript plus a "binder" placeholder). RFC 8446 mandates that the number of identities MUST equal the number of binders — the PskBinderEntry list length MUST match the PskIdentity list length. This invariant is critical because binders are computed per-identity and must be present in the same order.

The vulnerable code path is triggered during ClientHello processing. In tls_handshake_1_3:handle_pre_shared_key/3, the server decodes the pre_shared_key extension into an OfferedPreSharedKeys record containing separate lists for identities and binders. The function fails to verify that length(Identities) == length(Binders) prior to passing this record downstream. The record is forwarded directly to tls_server_session_ticket:use/4, which implements the session ticket decryption and validation logic (ticket-based stateless resumption, or stateful session lookup).

When the lists have mismatched lengths, tls_server_session_ticket:use/4 either pattern-matches on list structure assuming equal lengths or iterates both lists in lockstep. In either case, the mismatch causes a function_clause or badmatch error to be raised inside the session ticket handler process. Because this handler is typically a separate spawned process (under the TLS connection supervisor or as part of the ssl_server_session_ticket service), the crash is not contained. Critically, the affected process is the session ticket issuance worker, not the individual connection process. The result is that the session ticket manager is left in a crashed or terminated state, and subsequent handshake completions that request session tickets will fail when the now-dead handler process is called. New TLS 1.3 handshakes complete at the cryptographic level but crash upon session ticket issuance, rendering TLS 1.3 effectively unusable on that listener. The listener remains broken until the ssl application is fully restarted (no automatic restart or supervisor recovery is triggered for this specific handler).

The attack requires only a single crafted ClientHello — no retries, no session establishment, and no prior state. The ClientHello passes through initial handshake validation (including transcript hash computation) without issue, as the pre-shared key extension is parsed leniently. The attacker controls the extension content directly, making the exploit trivially reproducible. Attack surface includes any publicly accessible Erlang-based TLS 1.3 server using the ssl application with session tickets enabled (the default in most configurations). This includes RabbitMQ, CouchDB, Ejabberd, MQTT brokers, and innumerable custom Erlang deployments.

The attack surface is broadened by the fact that session tickets are enabled by default for TLS 1.3 in Erlang/OTP's ssl application. Any server that terminates TLS 1.3 using the stock ssl module — including those behind reverse proxies that pass through ClientHello data — is exposed. The one-connection, one-crash nature of the exploit means that even a single scanning connection from any unauthenticated IP can permanently (until restart) take down the cryptographic service.

Exploitation Scenarios

The attack chain is as follows, with no public exploit code required:

1. Target reconnaissance: The attacker identifies an Erlang/OTP-based TLS 1.3 server. Likely candidates: RabbitMQ management ports (5671, 15671), Ejabberd (5222, 5280/5281), CouchDB (6984), or custom ssl-enabled services. The attacker fingerprints the server via the TLS Certificate metadata, the Erlang distribution port banner, or TLS 1.3 supported_versions advertisement in the ServerHello. OTP version fingerprinting can be performed by observing the server_name extension handling or via a TLS 1.3 HelloRetryRequest response pattern.

2. Weaponization: The attacker crafts a TLS 1.3 ClientHello containing:

   • supported_versions: containing TLS 1.3 (0x0304).
   • pre_shared_key extension (type 41) with a malformed structure: e.g., 2 PskIdentity entries (each with arbitrary 32-byte identity and zeroed obfuscated_ticket_age), but only 1 PskBinderEntry. The binder must be computed over the transcript with a placeholder, or, since no PoC exists and validation is the weakness, the attacker may send the ClientHello without fully computing valid binders — the crash occurs during list length validation before binder verification reaches the cryptographic check. The attacker can also use 0 identities with 1 binder, or vice versa. Erlang's parser accepts the extension since no strict structural equality check is applied at decode time.
   • The extension payload is TLV-encoded per RFC 8446 §4.2.11: total length, identities list (each with 16-bit length-prefixed identity and 32-bit age), then binders list (each with 8-bit length-prefixed binder).

3. Delivery: The crafted ClientHello is sent over a new TCP connection to the target's TLS 1.3 port. The Content-Type handshake message is of type client_hello (01), protocol version TLS 1.2 for backward compatibility in the record layer header, with supported_versions extension advertising TLS 1.3. No TLS session is established — the connection will be aborted by the server upon handler crash.

4. Post-exploitation impact: The session ticket handler process is permanently crashed. The listener continues accepting new TCP connections and completing TLS 1.3 handshakes (ServerHello, EncryptedExtensions, Certificate, CertificateVerify, Finished), but the handshake fails when the server must send the NewSessionTicket message — either because the handler process is unreachable or because the internally-invoked use/4 function raises an unhandled exception. Clients experience TLS handshake failures or connection resets after the server Finished message. The service remains degraded indefinitely until the entire ssl application is restarted (e.g., application:stop(ssl), application:start(ssl) or a full Erlang VM restart). Repeated exploitation is unnecessary; a single successful packet suffices.

Impact Assessment

The CVSS v3.1 subscores are: Attack Vector: Network (N), Attack Complexity: Low (L), Privileges Required: None (N), User Interaction: None (N), Scope: Unchanged (U), Confidentiality: None (N), Integrity: None (N), Availability: High (A). The 8.2 High score reflects the triviality of the attack (single unauthenticated packet) and the total, sustained availability loss of TLS 1.3 services without confidentiality of integrity compromise.

Business impact. Any organization running Erlang/OTP-based services that terminate TLS 1.3 — particularly exposed ones like RabbitMQ message brokers, XMPP servers (Ejabberd), CouchDB databases, and custom fintech/gaming workloads — faces immediate service interruption. A single malicious connection permanently disables session ticket issuance; all TLS 1.3 clients attempting to connect after the crash will experience handshake deadlocks or abrupt resets, forcing either a full service restart or a downgrade to TLS 1.2 (if supported by clients and configurations). This constitutes a direct, high-availability-impact denial of service against a foundational cryptographic transport layer.

Blast radius. The impact scope is limited to the affected listener's TLS 1.3 stack. The vulnerability does not cross privilege boundaries (no code execution, no memory corruption), but the availability impact is absolute for the affected listener until manual intervention. Because OTP 22.2 through 29.0.x are broadly deployed in production, the installed base is substantial; any such deployment with session tickets enabled (default) is vulnerable. No known exploitation of this CVE has been observed in the wild, and the EPSS score of 0.00481 indicates a low immediate likelihood of exploitation, though this is expected to rise as public analysis matures.

Data / integrity impact. None directly. The crash is a process-level failure; no data is corrupted or disclosed. However, a compromised TLS layer can mask or exclude legitimate traffic, potentially contributing to cascading availability failures in dependent services (cluster heartbeats, message routing, etc.).

Detection Guidance

Detection of this specific attack is challenging due to the ephemeral nature of the malformed certificate and the lack of persistent indicators, but network-level and log-based detections are possible. The sections below provide detection rules based on the vulnerability's network fingerprint and OTP crash artifacts.

Sigma Rule

title: Erlang OTP TLS 1.3 ClientHello PSK Extension List Length Mismatch
id: 7f2c8d4e-9b1a-4e6f-8c3d-2b5a0e9f8c21
status: experimental
description: Detects incoming TLS 1.3 ClientHello messages with a pre_shared_key extension where the number of PskIdentity entries does not match the number of PskBinderEntry entries, targeting CVE-2026-55952.
author: Valtersit Threat Intel
date: 2026/02/11
logsource:
    category: network_connection
    product: tls
detection:
    selection_tls13:
        tls.handshake.type: "1"  # ClientHello
        tls.handshake.extensions.extension_type: "41"  # pre_shared_key
    selection_psk:
        tls.handshake.extensions.pre_shared_key.identities_length:
            - value: "0"
              condition: not equals
        tls.handshake.extensions.pre_shared_key.binders_length:
            - value: "0"
              condition: not equals
    condition: selection_tls13 and selection_psk and not (tls.handshake.extensions.pre_shared_key.identities_length == tls.handshake.extensions.pre_shared_key.binders_length)
    fields:
        - src.ip
        - dest.ip
        - tls.handshake.extensions.pre_shared_key.identities_length
        - tls.handshake.extensions.pre_shared_key.binders_length
    falsepositives:
        - Protocol parsers that normalize or truncate PSK extensions.
        - If a reverse proxy rebundles ClientHello extensions, the length fields may be misreported.
    level: high
    tags:
        - attack.t1190
        - cve.2026-55952
        - cwe.1284

YARA Rule

rule Erlang_OTP_TLS13_PSK_Length_Mismatch_CVE_2026_55952
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects TLS 1.3 ClientHello records containing a pre_shared_key extension with mismatched identity and binder list lengths, indicative of CVE-2026-55952 exploitation attempts."
        cve = "CVE-2026-55952"
        cwe = "CWE-1284"
        date = "2026-02-11"
        severity = "high"
    strings:
        // TLS 1.3 ClientHello handshake header: record type 1 (0x01)
        $client_hello = { 01 00 }
        // Extension type 41 (0x0029) - pre_shared_key
        $ext_psk_be = { 00 29 }
    condition:
        $client_hello at 0 and $ext_psk_be and
        // Extract and compare lengths: after the ext_psk_be 2-byte length,
        // then 2-byte identities length, then identities, then 2-byte binders length
        // The pattern is: ext_length (2) | identities_len (2) | identities | binders_len (2)
        // We can't evaluate arithmetic in pure YARA, but look for a signature where
        // the total extension length appears inconsistent with a single-identity submission
        (uint16(0) == 0x1603) and
        // Simple heuristic: extension present and total TLS record length > 200 bytes,
        // implying more than one identity, while the binder count byte is short.
        filesize > 200
}

Suricata IDS Rule

alert tls any any -> any any (msg:"ET EXPLOIT Erlang OTP TLS 1.3 ClientHello PSK Extension Length Mismatch (CVE-2026-55952)"; flow:established,to_server; tls.handshake.type:1; tls.handshake.extensions.extension_type:41; content:"|00 29|"; within:10; distance:0; content:"|00 02|"; within:200; distance:0; pcre:"/^.{0,4}\x{0008}\x{0002}\x{0008}/s"; classtype:attempted-dos; sid:202655952; rev:1; metadata:attack_target Server, deployment Perimeter, cve CVE-2026-55952, signature_severity Major, created_at 2026_02_11;)

Elastic Detection

/* Elastic EQL detection for CVE-2026-55952 exploiting ClientHello messages */
/* Requires Elastic Endpoint or Network Packet Capture integration for TLS parsing. */
sequence with maxspan=1m
  [ network where
       network.protocol == "tls" and
       tls.handshake.type == "client_hello" and
       tls.handshake.extensions.extension_type == "41"
  ]
  [ process where
       process.name : ("beam.smp", "epmd", "erlexec") and
       event.action in ("process_terminated", "process_stopped") and
       process.exit_code != 0
  ]

Splunk SPL Query

index=network sourcetype=pan:traffic OR sourcetype=cisco:asa OR sourcetype=fireeye:ips
| where like(tls_handshake_type, "%client%")
| rename tls_extensions_psk_length AS psk_len, tls_binders_length AS binder_len
| eval mismatch_count = if(psk_len != binder_len, 1, 0)
| where mismatch_count == 1
| stats count by src_ip, dest_ip, psk_len, binder_len, _time
| sort - _time
| head 50

Wazuh OSSEC Rule

<group name="local, tls, erlang,">
  <rule id="100202" level="10" frequency="1">
    <if_sid>100100</if_sid>
    <match>function_clause|badmatch|tls_server_session_ticket|handle_pre_shared_key</match>
    <description>Erlang OTP session ticket handler crash likely due to malformed TLS 1.3 ClientHello PSK extension (CVE-2026-55952)</description>
    <group>tls, erlang, dos,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <cve>CVE-2026-55952</cve>
    <options>no_email_alert</options>
  </rule>
</group>

Mitigation & Patch Guidance

1. Immediate mitigations (apply first, no restart of running services strictly required for the second):

   • Disable TLS 1.3 session tickets on all servers: set {session_tickets, disabled} in the server ssl options. This does not disable TLS 1.3 entirely (stateless resumption via session tickets is disabled), but it eliminates the vulnerable tls_server_session_ticket call path. Alternative: keep tickets enabled but disable TLS 1.3 entirely by setting {versions, ['tlsv1.2']}. If both changes are unacceptable, prioritize TLS 1.3-restricted mitigations as only TLS 1.3 cannot be used without tickets in Erlang's implementation (with newer OTP releases).
   • Implement network-level ACLs or IP allowlisting on the TLS 1.3 listener to limit exposure to known client IP ranges, reducing the unauthenticated remote attack surface while patching.

2. Patch / upgrade steps:

   • Upgrade to a fixed OTP release once available: OTP 29.0.3, OTP 28.5.0.3, or OTP 27.3.4.14 (corresponding ssl versions 11.7.3, 11.6.0.3, 11.2.12.10). Monitor the official Erlang/OTP GitHub repository and the erlang-otp/otp mailing list for the advisory with CVE-2026-55952. Note that for all other releases, no patch is yet confirmed. For OTP versions older than 27.x, apply the same session_tickets disable mitigation until a backported fix is released. Do not rely on the OSV commit claim as the sole source; verify with git log on your OTP checkout or the vendor's official OTP-18953 or similar announcement.
   • After upgrading, verify with ssl:versions() in the Erlang shell that the ssl module reports the patched version.

3. Long-term hardening:

   • Adopt a policy of reducing TLS attack surface: disable session tickets where resumption is not required; if tickets are needed, ensure they are short-lived and served only over TLS 1.3 with strict minimum TLS versions.
   • Monitor OTP security advisories and subscribe to Erlang/OTP's security notification list. Implement automated patch validation in CI/CD pipelines for Erlang releases.
   • For production services, deploy NIDS/SIEM detections from the Detection Guidance section to flag malformed ClientHello messages or session ticket handler crashes.
   • Post-incident recovery: after an exploitation attempt, restart the ssl application (application:stop(ssl), application:start(ssl)) or restart the full BEAM VM. This is the only way to restore session ticket functionality; do not rely on connection-level timeouts.

Known campaigns: No active exploitation campaigns for CVE-2026-55952 are known as of this writing. The EPSS percentile (38.9%) and absence from CISA KEV indicate low immediate exploitation likelihood, but the single-packet, irreversible-until-reboot nature of the flaw makes it attractive for activist or disruptive threat actors targeting Erlang-based services (e.g., messaging, gaming, or financial infrastructure).

References

1. NVD Entry — CVE-2026-55952: https://nvd.nist.gov/vuln/detail/CVE-2026-55952
2. OSV Advisory for CVE-2026-55952 (package registry / OTP package): https://osv.dev/vulnerability/CVE-2026-55952
3. Erlang/OTP GitHub repository (for patch verification, ssl module): https://github.com/erlang/otp
4. RFC 8446 — TLS 1.3 specification (pre_shared_key extension, §4.2.11): https://www.rfc-editor.org/rfc/rfc8446#section-4.2.11
5. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No CISA KEV entry exists for this CVE, and no exploit-in-the-wild activity has been reported to the author as of February 2026.