SEC.co
Emergency

By weakness (CWE)

CWE-1394: related vulnerabilities

CVEs classified under CWE-1394. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-54887MEDIUM 4.8

    Erlang/OTP's DTLS server uses a predictable cookie value during startup instead of a random one, allowing attackers to forge valid DTLS cookies within a narrow window (0-15 seconds after server restart). The DTLS cookie is a security mechanism designed to prevent attackers from using spoofed IP addresses to force a server into expensive cryptographic operations. By observing unencrypted ClientHello messages, an attacker can compute the cookie themselves and bypass this protection, enabling amplification attacks with forged source addresses. This affects DTLS deployments in OTP versions 20.0 through 29.0.2 and specific patch releases.