Erlang/OTP -- TLS denial of service using invalid certificate chains

2026-07-27 · CVE-2026-58227 · VuXML entry

https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw reports: A TLS/DTLS peer can crash the remote node by sending a certificate chain containing two mutually cross-signed certificates in unordered form. When the receiving side attempts to build a valid chain path, it enters unbounded recursion between the two certificates (A issues B, B issues A) with no cycle detection or depth limit. The call …

Affected versions

• erlang >= 23.2,4 < 28.5.0.4,4
• erlang-runtime27 < 27.3.4.15
• erlang-runtime28 < 28.5.0.4
• erlang-runtime29 < 29.0.4

By system

3 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.