CVE-2026-59251
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A resource allocation vulnerability in Erlang/OTP's public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during TLS handshake. The certificate policy tree grows without bounds, exhausting BEAM schedulers and node memory, crashing the entire VM. This affects all TLS connections that validate peer certificates by default.
Risk Assessment
The organization is at risk of DoS attacks on all TLS connections (incoming and outgoing) that perform certificate chain validation. An attacker can crash the entire Erlang/OTP VM, impacting service availability.
Recommendation
Immediately upgrade Erlang/OTP to version OTP 29.0.4, OTP 28.5.0.4, or OTP 27.3.4.15, and public_key to version 1.21.4, 1.20.3.4, or 1.17.1.5. If patching is not possible, consider restricting trusted certificate chains or implementing firewall rules to block suspicious TLS connections.
Other vulnerabilities in Erlang/OTP public_key
See all- CVE-2026-42790High
A vulnerability in the Erlang OTP public_key library allows bypassing DNS nameConstraints via subject CommonName fallback in TLS hostname verification. Two flaws enable a subordinate CA with restricted DNS nameConstraints to issue a leaf certificate accepted for an out-of-scope hostname.
- CVE-2026-42789Medium
A vulnerability in the Erlang OTP public_key library (pubkey_cert module) allows improper following of a certificate's chain of trust. A non-CA certificate with basicConstraints cA:false and no keyUsage extension is incorrectly accepted as an intermediate issuer, enabling certificate chain forgery. Affected OTP versions: 17.0 through 29.0.1, 28.5.0.1, 27.3.4.12, and 26.2.5.21.
Original NVD description (English source)
Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers). This is the same vulnerability class as OpenSSL's X509_verify_cert policy tree DoS. This vulnerability is associated with program files lib/public_key/src/pubkey_policy_tree.erl and program routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2. This issue affects OTP from OTP 26.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.17.1.5.