CVE-2026-55952
Description
A flaw was found in Erlang/OTP's SSL (Secure Sockets Layer) application. An unauthenticated remote attacker can send a specially crafted ClientHello message to a TLS 1.3 server with session tickets enabled. This can permanently disrupt the server's ability to handle session tickets, leading to a Denial of Service (DoS) for new TLS 1.3 connections until the SSL application is restarted. This vulnerability is caused by improper validation of PSK (Pre-Shared Key) identity and binder list lengths.
Statement
A flaw was found in the Erlang/OTP ssl application. The TLS 1.3 session ticket handler does not validate that PSK identity and binder lists have equal length, allowing an unauthenticated attacker to crash session ticket handling via a crafted ClientHello, making TLS 1.3 unusable until the ssl application is restarted.
Mitigation
Restarting the ssl application restores TLS 1.3 functionality after a crash. TLS 1.2 connections are not affected. Disabling TLS 1.3 session tickets (stateful and stateless) eliminates the attack surface.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Memory; Modify Memory; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
