Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate …
Summary
Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the o…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Lint boundary warnings (1)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://www.erlang.org/doc/system/versions.html#order-of-versions
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-59251.html Patch
- https://github.com/erlang/otp/commit/f04c6bba38de1cf1b1836a7d9a9fbe239bd939e8 Patch
- https://github.com/erlang/otp/commit/f8580fc117098c08165f46c26fd0750c5cfb2a90 Patch
- https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352 Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-59251 Patch
- https://www.erlang.org/doc/system/versions.html#order-of-versions Release Notes
Timeline
- nvd_ingest NVD