This vulnerability arises because the DTLS server in Erlang/OTP initializes the previous_cookie_secret to an empty binary instead of a random value during startup. Since HMAC with an empty key is deterministic, an attacker who observes the ClientHello message can compute the DTLS cookie before the first secret rotation (which occurs within 0 to 15 seconds). This enables bypass of source address verification, allowing DTLS handshake amplification with spoofed source addresses during this startup window. The affected code is in lib/ssl/src/dtls_server_connection.erl, specifically the dtls_server_connection:initial_hello/3 function. The vulnerability affects OTP versions from 20.0 before 29.0.3, 28.5.0.3, and 27.3.4.14, corresponding to ssl versions from 8.2 before 11.7.3, 11.6.0.3, and 11.2.12.10.

An attacker capable of observing plaintext ClientHello messages during the initial DTLS server startup window can bypass source address verification by forging valid DTLS cookies. This allows handshake amplification attacks with spoofed source IP addresses, potentially increasing denial-of-service risks. The DTLS cookie is not an authentication mechanism, so the impact is limited to denial-of-service amplification rather than unauthorized access or data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider minimizing exposure during server startup or implementing network-level controls to limit spoofed traffic. Monitor vendor communications for updates on remediation.