UpHeron
All vulnerabilities

Servers and applications

CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer…

Severity
High 8.7
Published
27 Jul 2026
Last changed
10 Aug 2026
Added to UpHeron
16 Oct 2026
Fixed in
27.3.4.15, 28.5.0.4, 29.0.4
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 23.2 before 27.3.4.15
  • From 28.0 before 28.5.0.4
  • From 29.0 before 29.0.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-58227
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-58227