The Erlang/OTP ssl application fails to detect cycles when rebuilding an incomplete peer certificate chain in a TLS or DTLS handshake. When a peer supplies two mutually cross‑signed certificates in unordered form, the chain reconstruction logic recurses without a depth limit, overflowing the call stack and consuming unlimited memory. An unauthenticated attacker can send such a chain in a Certificate handshake message, exhausting memory and crashing the BEAM node. The result is a denial of service for both servers and clients that process peer certificates. The flaw is classified as CWE‑674 (Uncontrolled Recursion).

The vulnerability affects the Erlang/OTP platform, specifically the ssl application. It exists in OTP versions earlier than 29.0.4, 28.5.0.4, and 27.3.4.15, which correspond to ssl releases before 11.7.4, 11.6.0.4, and 11.2.12.11, respectively. Production deployments running any of those OTP releases are susceptible when the ssl module processes client or server certificate chains.

The flaw carries a CVSS score of 8.7, classifying it as high severity. Because the attack requires only a TCP connection and a partial TLS/DTLS handshake, no authentication or completed handshake is needed, making it easier for remote actors to trigger. The EPSS score of 0.0035 (< 1%) indicates a very low but nonzero probability of exploitation, and the vulnerability is not currently listed in CISA’s KEV catalog; nevertheless, the low EPSS does not diminish the danger posed by the simple attack steps. A remote attacker can repeatedly send crafted certificate chains to flood the BEAM node’s memory, causing widespread service disruption across any Erlang/OTP system that accepts certificates from untrusted peers.