The vulnerability arises because the DTLS server in Erlang/OTP initializes the previous_cookie_secret to an empty binary on startup, causing the HMAC used for DTLS cookie computation to be deterministic and predictable during the first 0 to 15 seconds before the secret rotates. An attacker who can observe the ClientHello message can forge valid DTLS cookies and bypass the source address verification that normally prevents spoofed IP addresses from forcing the server to allocate resources. This can enable DTLS handshake amplification attacks with spoofed source addresses. The issue affects multiple OTP and ssl versions as specified. The DTLS cookie mechanism is a denial-of-service mitigation, not an authentication feature.

During the initial startup window of the DTLS server, attackers can bypass source address verification by forging valid DTLS cookies, potentially enabling denial-of-service amplification attacks with spoofed source IP addresses. This weakens the server's ability to mitigate resource exhaustion attacks during this window. The vulnerability does not affect authentication or confidentiality directly but impacts the robustness of denial-of-service protections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a fix is available, administrators should be aware of the startup window risk and consider mitigating exposure during server restarts if possible.