This vulnerability arises because the DTLS server in Erlang/OTP initializes the previous_cookie_secret to an empty binary at startup instead of a random value. Since HMAC with an empty key is deterministic, an attacker observing the ClientHello message can compute a valid DTLS cookie before the first secret rotation occurs (within 0 to 15 seconds). This allows bypassing source address verification, which is designed to prevent denial-of-service attacks by verifying the client's IP address. The issue is located in the dtls_server_connection:initial_hello/3 function in the Erlang ssl library. Affected versions include OTP 20.0 up to but not including 29.0.3, 28.5.0.3, and 27.3.4.14, and ssl versions from 8.2 up to but not including 11.7.3, 11.6.0.3, and 11.2.12.10.

An attacker capable of observing plaintext ClientHello messages during the server startup window can bypass source address verification in the DTLS handshake. This bypass undermines the denial-of-service mitigation mechanism, potentially enabling handshake amplification attacks with spoofed source IP addresses. However, this does not compromise authentication or confidentiality directly. The vulnerability is limited to a short time window (0 to 15 seconds) after server startup before the cookie secret rotates to a random value.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, consider minimizing server restarts or monitoring DTLS handshake behavior during startup. Avoid relying solely on DTLS cookie verification during the initial startup window for critical security decisions.