CVE-2026-59251

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 26.2 through 27.3.4.14 Erlang/OTP versions 28.0 through 28.5.0.3 Erlang/OTP versions 29.0 through 29.0.3 public key versions 1.15 through 1.17.1.4 public key versions 1.20 through 1.20.3.3 public key versions 1.21 through 1.21.3

Description Resource allocation without limits in the certificate path validation of the public key module allows a remote unauthenticated attacker to cause a denial of service. By sending a crafted X.509 certificate chain during a TLS handshake, an attacker can trigger unbounded growth of the certificate policy tree during RFC 5280 policy processing in the pkix path validation/3 function. This occurs because the functions pubkey policy tree:add leaves/2 and pubkey policy tree:add leaf siblings/2 extend the tree per policy per certificate, leading to exponential growth. This can pin BEAM schedulers and exhaust node memory, resulting in a complete virtual machine crash. The issue affects any incoming or outgoing TLS connection that validates the peer's chain, such as SSL/TLS clients and mutual-TLS servers.

Recommendations Update Erlang/OTP to version 27.3.4.15, 28.5.0.4, or 29.0.4. Update public key to version 1.17.1.5, 1.20.3.4, or 1.21.4.