Loading vulnerability…
Erlang/OTP Certificate Policy Tree Resource Exhaustion
CVE-2026-59251 is an unbounded resource allocation vulnerability in Erlang/OTP public_key certificate path validation. During RFC 5280 policy processing in public_key:pkix_path_validation/3, pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 expand the certificate policy tree without an upper bound. A chain containing M policies per certificate and K certificates can produce approximately M^K tree nodes. A remote unauthenticated attacker can submit a crafted X.509 certificate chain during a TLS handshake to exhaust CPU and memory and terminate the Erlang VM. The issue affects Erlang/OTP beginning with 26.2, with fixed releases including 27.3.4.15, 28.5.0.4, and 29.0.4, corresponding to public_key 1.17.1.5, 1.20.3.4, and 1.21.4.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing a malicious certificate chain can pin BEAM schedulers and exhaust node memory, causing denial of service across the entire Erlang VM rather than only the initiating TLS connection. All applications sharing that VM may become unavailable. Both TLS clients and mutual-TLS servers that validate peer certificate chains are exposed. No confidentiality or integrity impact is established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until patched, restrict access to affected mutual-TLS services to trusted networks and limit outbound TLS connections from Erlang applications to trusted endpoints. These controls reduce opportunities to present malicious certificate chains but do not correct the unbounded policy-tree growth. Do not disable certificate validation as a workaround.
Patch, then assume compromise.
Upgrade Erlang/OTP to the applicable fixed release: 27.3.4.15, 28.5.0.4, 29.0.4, or a later patched release. Corresponding fixed public_key versions are 1.17.1.5, 1.20.3.4, and 1.21.4. Alternatively, install distribution packages containing backported fixes: Fedora 43 erlang-26.2.5.21-7.fc43, Fedora 44 erlang-26.2.5.21-7.fc44, or Debian trixie erlang 1:27.3.4.1+dfsg-1+deb13u3 or later. For Ubuntu 26.04 LTS, install the Erlang security updates associated with USN-8827-1. Restart affected Erlang services or reboot to ensure the patched components are loaded.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.