Description
Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.

During RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers).

This is the same vulnerability class as OpenSSL's X509_verify_cert policy tree DoS.

This vulnerability is associated with program files lib/public_key/src/pubkey_policy_tree.erl and program routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2.

This issue affects OTP from OTP 26.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.17.1.5.
Published: 2026-07-27
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Erlang/OTP’s X.509 certificate path validation does not limit the size of the policy tree that is built during RFC 5280 policy processing. When a chain contains many policies per certificate, the tree can grow on the order of M^K nodes, where K is the number of certificates. The resulting memory consumption can exhaust the BEAM scheduler and bring the entire virtual machine down. This flaw is a classic resource exhaustion vulnerability (CWE‑770) and can be triggered by a simple, unauthenticated TLS handshake that submits a crafted certificate chain.

Affected Systems

The issue applies to Erlang/OTP releases prior to OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, which correspond to the public_key library versions before 1.21.4, 1.20.3.4 and 1.17.1.5 respectively. All installations that rely on the default public_key path validation for TLS connections are susceptible.

Risk and Exploitability

The CVSS score of 8.7 indicates a high‑severity Denial of Service risk. An EPSS score of less than 1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack requires only the ability to establish a TLS session, which is typically possible for any network endpoint that performs peer verification. Once a malicious certificate chain is presented, the victim’s scheduler locks, memory is consumed, and the VM crashes. Because the flaw is remote and does not need privileged access, it is a realistic threat for any public service that accepts TLS connections.

Generated by OpenCVE AI on August 3, 2026 at 17:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Erlang/OTP to release 29.0.4 or newer, ensuring the public_key library is at least version 1.21.4.
  • Plan to upgrade as soon as possible; if an immediate upgrade is not feasible, limit the exposure by temporarily disabling policy tree validation for TLS connections that do not require guaranteed policy compliance, noting the potential security trade‑offs.
  • Monitor TLS handshake logs for unusually long certificate chains and large policy trees, and alert when such activity is detected to enable rapid response.

Generated by OpenCVE AI on August 3, 2026 at 17:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Mon, 27 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Erlang otp
Vendors & Products Erlang erlang/otp
Erlang otp

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers). This is the same vulnerability class as OpenSSL's X509_verify_cert policy tree DoS. This vulnerability is associated with program files lib/public_key/src/pubkey_policy_tree.erl and program routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2. This issue affects OTP from OTP 26.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.17.1.5.
Title Denial of service via exponential certificate policy tree growth in path validation
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-770
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L'}

Subscriptions

Erlang Erlang/otp Erlang\/otp Erlang\/public Key Otp
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-07-28T09:54:59.169Z

Reserved: 2026-07-04T04:24:03.653Z

Link: CVE-2026-59251

cve-icon Vulnrichment

Updated: 2026-07-27T18:32:04.356Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T16:18:03.517

Modified: 2026-08-10T14:49:23.310

Link: CVE-2026-59251

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-27T15:30:47Z

Links: CVE-2026-59251 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T17:15:12Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling