UpHeron
All vulnerabilities

Servers and applications

CVE-2026-59251

Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When…

Severity
High 8.7
Published
27 Jul 2026
Last changed
10 Aug 2026
Added to UpHeron
16 Oct 2026
Fixed in
27.3.4.15, 28.5.0.4, 29.0.4
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 26.2 before 27.3.4.15
  • From 28.0 before 28.5.0.4
  • From 29.0 before 29.0.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-59251
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-59251