Erlang/OTP -- denial of service via exponential certificate policy tree growth

2026-07-27 · CVE-2026-59251 · VuXML entry

https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352 reports: A remote attacker can trigger a denial of service through TLS certificate handling. By sending a specially crafted certificate chain with multiple certificate policies at each level, the policy tree expands exponentially during validation, growing as M^K nodes (where M is the number of policies per certificate and K is the chain depth). …

Affected versions

• erlang >= 26.2,4 < 28.5.0.4,4
• erlang-runtime27 < 27.3.4.15
• erlang-runtime28 < 28.5.0.4
• erlang-runtime29 < 29.0.4

By system

2 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.