Multiple Erlang/OTP Flaws Enable Remote DoS and VM Crashes

Erlang/OTP users were urged to patch after multiple vulnerabilities were disclosed across the platform, including high-severity flaws that can crash BEAM nodes or exhaust resources during normal protocol handling. CVE-2026-59251 affects public_key certificate path validation, where a crafted X.509 chain can trigger exponential certificate policy tree growth during a TLS handshake and consume CPU and memory until the VM fails. CVE-2026-58227 affects the ssl application, where mutually cross-signed certificates can cause unbounded recursion while rebuilding incomplete TLS or DTLS peer chains, allowing an unauthenticated attacker to crash either servers or clients before authentication completes.

A separate high-severity flaw, CVE-2026-54890, impacts the erts External Term Format decoder used by binary_to_term/1, binary_to_term/2, and enif_binary_to_term(), where an integer underflow in BIT_BINARY_EXT decoding can trigger near-2^64 memory allocation and terminate the entire Erlang VM. National cyber authorities in Canada and Italy published advisories directing administrators to review Erlang security bulletins and update affected releases, while the Italian notice said the broader disclosure set includes additional Erlang/OTP issues spanning denial of service, remote code execution, authentication bypass, and security feature bypass. Fixed versions cited across the disclosures include 27.3.4.15, 28.5.0.4, and 29.0.4.