Description
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake.

The BER OID decoder asn1rtt_ber:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_ber.erl and the equivalent PER helper asn1rtt_per_common:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_per_common.erl accumulate a base-128 subidentifier into an unbounded integer using (Av bsl 7) + H per continuation byte. Each shift and addition on the growing accumulator is linear in the number of bits already accumulated, giving quadratic total work in the size of a single subidentifier. The JER helper asn1rtt_jer:json2oid/1 in lib/asn1/src/asn1rtt_jer.erl exhibits the same class of unbounded-integer parsing when decoding a dot-separated OID from JSON. A DER-encoded OBJECT IDENTIFIER with one very large arc (approximately 262 KB of continuation bytes) consumes roughly 13 seconds of CPU on typical hardware.

The vulnerable decoder is generated into every ASN.1 module that contains an OBJECT IDENTIFIER, including OTP-PUB-KEY which is reached during X.509 certificate parsing via public_key:pkix_decode_cert/2. This decoder runs before any signature or trust chain verification, so any Erlang service that parses peer TLS certificates is exposed: the default for TLS clients (which always parse the server certificate) and for mutual-TLS servers (which parse client certificates).

This vulnerability is associated with program files lib/asn1/src/asn1rtt_ber.erl, lib/asn1/src/asn1rtt_per_common.erl and lib/asn1/src/asn1rtt_jer.erl and program routines asn1rtt_ber:dec_subidentifiers/3, asn1rtt_per_common:dec_subidentifiers/3 and asn1rtt_jer:json2oid/1.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to asn1 from 3.0 before 5.3.4.3, 5.4.3.1, and 5.5.2. Whether OTP before OTP 17.0, corresponding to asn1 before 3.0, is affected is unknown.
Published: 2026-09-22
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (CPU exhaustion)
Action: Patch immediately
AI Analysis

Impact

An algorithmic inefficiency in the ASN.1 OBJECT IDENTIFIER decoder of Erlang/OTP causes quadratic growth of CPU usage when parsing a subidentifier of very large size. A remote unauthenticated attacker can send a crafted OID in a TLS certificate during the handshake, forcing the decoder to consume an excessive amount of CPU time and resulting in denial of service. The flaw is catalogued as CWE‑407. Because the decoder is invoked before any signature or trust verification, any Erlang service that parses peer certificates—default for TLS clients and for mutual‑TLS servers—can be impacted, potentially making the entire process unresponsive.

Affected Systems

This issue affects Erlang:OTP releases from OTP 17.0 up to, but not including, OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1. The corresponding asn1 library versions are 3.0 before 5.3.4.3, 5.4.3.1, and 5.5.2. Versions of OTP older than 17.0 are unknown to be affected. Any Erlang environment that embeds ASN.1 modules containing OBJECT IDENTIFIERs, such as OTP‑PUB‑KEY used in X.509 parsing, is potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.2 marks this flaw as high severity. Exploitation is remote and requires no authentication, and an attacker can initiate a TLS handshake with a specially crafted certificate to trigger the decoder. Because the vulnerability is present before signature verification, the attacker gains no additional privilege; the outcome is a CPU‑based denial of service. The EPSS score is not available, and the flaw is not currently listed in CISA’s KEV catalog. As a result, the risk is high for any deployment that accepts external TLS connections and does not apply mitigations.

Generated by OpenCVE AI on September 22, 2026 at 10:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Erlang/OTP to a patched release (OTP 27.3.4.19 or later, OTP 28.5.0.8 or later, OTP 29.1.1.x).
  • If an upgrade cannot be performed immediately, configure the TLS library or your application to validate the length of certificate OIDs and reject those that exceed a reasonable threshold before decoding.
  • Deploy process or system‑level CPU monitoring to detect spikes caused by OID parsing and throttle or restart affected nodes as a temporary countermeasure.

Generated by OpenCVE AI on September 22, 2026 at 10:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Erlang otp
Vendors & Products Erlang erlang/otp
Erlang otp

Tue, 22 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Description Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rtt_ber:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_ber.erl and the equivalent PER helper asn1rtt_per_common:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_per_common.erl accumulate a base-128 subidentifier into an unbounded integer using (Av bsl 7) + H per continuation byte. Each shift and addition on the growing accumulator is linear in the number of bits already accumulated, giving quadratic total work in the size of a single subidentifier. The JER helper asn1rtt_jer:json2oid/1 in lib/asn1/src/asn1rtt_jer.erl exhibits the same class of unbounded-integer parsing when decoding a dot-separated OID from JSON. A DER-encoded OBJECT IDENTIFIER with one very large arc (approximately 262 KB of continuation bytes) consumes roughly 13 seconds of CPU on typical hardware. The vulnerable decoder is generated into every ASN.1 module that contains an OBJECT IDENTIFIER, including OTP-PUB-KEY which is reached during X.509 certificate parsing via public_key:pkix_decode_cert/2. This decoder runs before any signature or trust chain verification, so any Erlang service that parses peer TLS certificates is exposed: the default for TLS clients (which always parse the server certificate) and for mutual-TLS servers (which parse client certificates). This vulnerability is associated with program files lib/asn1/src/asn1rtt_ber.erl, lib/asn1/src/asn1rtt_per_common.erl and lib/asn1/src/asn1rtt_jer.erl and program routines asn1rtt_ber:dec_subidentifiers/3, asn1rtt_per_common:dec_subidentifiers/3 and asn1rtt_jer:json2oid/1. This issue affects OTP from OTP 17.0 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to asn1 from 3.0 before 5.3.4.3, 5.4.3.1, and 5.5.2. Whether OTP before OTP 17.0, corresponding to asn1 before 3.0, is affected is unknown.
Title Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-407
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-22T10:15:28.691Z

Reserved: 2026-07-22T13:58:26.233Z

Link: CVE-2026-65634

cve-icon Vulnrichment

Updated: 2026-09-22T10:15:21.666Z

cve-icon NVD

Status : Received

Published: 2026-09-22T09:17:05.090

Modified: 2026-09-22T11:17:24.857

Link: CVE-2026-65634

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T11:00:14Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity