CVE-2026-55952: Erlang/OTP TLS 1.3 Session Ticket Handler Denial of Service

Technical summary

The vulnerability exists in the tls_handshake_1_3:handle_pre_shared_key/3 function, which does not validate that the PSK identity list and binder list in the pre-shared key extension of a TLS 1.3 ClientHello have equal length. An OfferedPreSharedKeys record with mismatched list lengths is forwarded directly to tls_server_session_ticket:use/4 without validation, causing an uncaught exception that crashes the session ticket handler process. An attacker can trigger this by crafting a ClientHello with unequal identity and binder lists, resulting in a denial of service condition for TLS 1.3 session ticket operations on that listener.

Business impact

This vulnerability has direct operational impact on any service relying on Erlang/OTP for TLS 1.3 termination with session tickets enabled. A single crafted request from an unauthenticated attacker permanently disables TLS 1.3 session ticket handling on the affected listener, forcing a restart of the ssl application to restore functionality. While new TLS 1.3 handshakes can complete, they fail when the server attempts to issue a session ticket, effectively degrading TLS 1.3 usability. Organizations operating high-availability services may face extended outages if the crash occurs during business-critical periods. The attack requires no authentication and can be executed remotely, making it accessible to any network-adjacent attacker.

Affected systems

This vulnerability affects Erlang/OTP versions from 22.2 up to (but not including) OTP 29.0.3, as well as the maintenance branches OTP 28.5.0.3 and OTP 27.3.4.14. The corresponding ssl application versions impacted are 9.5 up to (but not including) 11.7.3, 11.6.0.3, and 11.2.12.10. The vulnerability is specific to TLS 1.3 deployments with session tickets enabled in either stateful or stateless mode. TLS 1.2 and earlier versions are not affected. Any application or service deployed on these Erlang/OTP versions that serves TLS 1.3 connections with session ticket support is vulnerable.

Exploitability

Exploitability is straightforward and requires no special privileges or authentication. An attacker needs only network connectivity to the target TLS 1.3 listener and the ability to craft a malformed ClientHello with unequal PSK identity and binder list lengths. The attack is a single-packet operation with deterministic results: the session ticket handler crashes immediately upon processing the crafted message. The low barrier to entry (CVSS score 7.5 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N) reflects the network-accessible, unauthenticated, and low-complexity nature of the attack. However, the impact is limited to availability of session ticket functionality rather than confidentiality or integrity compromise.

Remediation

Upgrade Erlang/OTP to version 29.0.3 or later, or apply the corresponding maintenance branch updates: OTP 28.5.0.3 or OTP 27.3.4.14. These versions include fixes that validate PSK identity and binder list parity before passing the OfferedPreSharedKeys record to the session ticket handler. Organizations unable to immediately upgrade should consider temporarily disabling session tickets on TLS 1.3 listeners if operationally feasible, though this may reduce performance for clients that rely on session resumption. Verify the ssl application version in your environment and plan upgrades according to your release management process.

Patch guidance

Consult the official Erlang/OTP release notes for versions 29.0.3, 28.5.0.3, or 27.3.4.14 to verify patch availability and any breaking changes or additional improvements bundled in those releases. Test patches in a staging environment that mirrors your TLS 1.3 session ticket configuration before deploying to production. Coordinate with your operations team to schedule a maintenance window for ssl application restarts, as reloading the patched code will temporarily affect active TLS 1.3 connections. Verify that your deployment tooling correctly rolls out the new Erlang/OTP version across all affected listeners and instances.

Detection guidance

Monitor for repeated crashes of the session ticket handler process (tls_server_session_ticket process) correlated with incoming TLS 1.3 ClientHello messages. Erlang/OTP will emit error logs when the handler crashes; search logs for exit reasons related to function_clause or bad match errors in handle_pre_shared_key/3. If you have TLS handshake logging enabled, look for ClientHello messages with suspicious or malformed pre-shared key extensions that differ in identity and binder list lengths. Network-level detection is challenging without deep packet inspection of TLS records, but persistent handler restarts on a listener should trigger alerts. Consider enabling verbose ssl application logging during the remediation window to gain visibility into the attack.

Why prioritize this

While the CVSS score is 7.5 (HIGH), prioritization depends on your deployment profile. If you operate TLS 1.3 services with session tickets enabled and require continuous availability, this should be treated as a priority. The attack is trivial to execute and requires no complexity, making it a realistic threat from any network-adjacent attacker. However, the impact is limited to session ticket functionality; the confidentiality and integrity of TLS 1.3 encrypted sessions are not compromised, nor are TLS 1.2 connections affected. If your service does not rely on session ticket resumption or if your user base tolerates occasional TLS 1.3 handshake failures, you may defer this to a standard maintenance cycle. Conversely, if you serve latency-sensitive or high-throughput clients that depend on session tickets, treat this as urgent to avoid customer-facing degradation.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required, yielding high exploitability. The impact is availability only (no confidentiality or integrity loss), capped at the affected listener's scope. The score does not account for business context, such as the limited attack surface (only TLS 1.3 with session tickets), the observable nature of the crash (facilitating detection), or the recovery mechanism (restarting ssl application). Organizations should supplement this technical score with risk assessment factors such as the criticality of TLS 1.3 session ticket resumption to their business, the attack surface exposed to untrusted networks, and the tolerability of brief availability disruptions.

Frequently asked questions