CVE-2026-59251 in OTP
Summary
by MITRE • 07/27/2026
Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake.
During RFC 5280 policy processing in public_key:pkix_path_validation/3, the certificate policy tree maintained by pubkey_policy_tree grows without an upper bound. When a certificate chain contains M policies per certificate and K certificates, the tree grows on the order of M^K nodes because pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 extend the tree per policy per certificate. A modest chain with many policies per certificate is enough to pin BEAM schedulers and exhaust the node's memory, taking down the entire VM. The attacker only needs to be able to present a certificate chain to the victim, which is the normal precondition for a TLS handshake, so exploitation succeeds against any incoming or outgoing TLS connection that validates the peer's chain (the default for SSL/TLS clients and mutual-TLS servers).
This is the same vulnerability class as OpenSSL's X509_verify_cert policy tree DoS.
This vulnerability is associated with program files lib/public_key/src/pubkey_policy_tree.erl and program routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2.
This issue affects OTP from OTP 26.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to public_key from 1.15 before 1.21.4, 1.20.3.4 and 1.17.1.5.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability described represents a critical denial of service flaw in Erlang/OTP's public_key module that stems from unbounded resource allocation during X.509 certificate path validation. This issue manifests when processing certificate chains that contain multiple policies per certificate, creating exponential growth in the policy tree structure maintained by the pubkey_policy_tree module. The fundamental technical flaw exists in the absence of any upper bounds or limits on memory allocation during certificate validation, allowing an attacker to exploit this weakness through carefully crafted certificate chains that trigger excessive resource consumption.
The operational impact of this vulnerability is severe and affects the entire Erlang virtual machine runtime environment. When a malicious certificate chain containing multiple policies per certificate is processed, the pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 functions cause the tree structure to expand exponentially according to the mathematical relationship M^K where M represents policies per certificate and K represents the number of certificates in the chain. This exponential growth pattern quickly consumes available memory resources and pins BEAM schedulers, effectively taking down the entire VM instance. The vulnerability operates at the TLS handshake level, making it particularly dangerous since any system accepting TLS connections must validate peer certificate chains by default.
The exploitation mechanism requires minimal privileges as attackers only need to present a malicious certificate chain to any target system that performs certificate validation during TLS handshakes. This includes both incoming connections on TLS servers and outgoing connections from TLS clients that perform mutual authentication. The attack vector is particularly insidious because it leverages normal TLS protocol behavior, making detection difficult and exploitation straightforward against any service using Erlang/OTP versions within the affected range. This vulnerability class is directly comparable to OpenSSL's X509_verify_cert policy tree denial of service issue, demonstrating similar patterns of exponential resource consumption through certificate policy processing.
From a security standards perspective, this vulnerability aligns with CWE-770, which addresses allocation of resources without limits or appropriate bounds, and represents a classic example of resource exhaustion attacks that can be classified under the ATT&CK technique T1499.3 for network denial of service. The affected software components specifically include lib/public_key/src/pubkey_policy_tree.erl with the vulnerable functions add_leaves/2 and add_leaf_siblings/2 that handle policy tree expansion without any bounds checking or resource limitations. The vulnerability affects multiple OTP releases including versions prior to 29.0.4, 28.5.0.4, and 27.3.4.15, indicating this was a persistent issue across several major release lines of the Erlang runtime environment.
Mitigation strategies should focus on upgrading to patched versions of OTP that implement proper bounds checking in certificate policy tree expansion, typically through limiting the maximum depth or number of nodes in the policy tree structure. Additionally, system administrators should consider implementing rate limiting and connection throttling mechanisms at network boundaries to prevent rapid exploitation attempts, while monitoring for unusual memory consumption patterns during TLS handshake processing. The most effective long-term solution involves applying security patches that introduce proper resource limits and bounds checking within the public_key module's certificate validation routines to prevent exponential tree growth under malicious input conditions.