PT-2026-64989 · Unknown · Erlang/Otp
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Erlang/OTP versions 23.2 through 27.3.4.14
Erlang/OTP version 28.5.0.3
Erlang/OTP version 29.0.3
Description
The ssl application fails to detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. Specifically, the function
handle incomplete chain/5 passes the chain to build certificate chain/5, which then uses do certificate chain/7 to walk issuer relationships without a depth limit or cycle detection. If a peer provides two mutually cross-signed certificates in an unordered form, the system recurses indefinitely, causing the call stack and chain accumulator to grow without bound. An unauthenticated remote attacker can exploit this by sending a crafted certificate chain in a handshake message to exhaust memory and crash the BEAM node. This affects both servers and clients and requires only a TCP connection and a partial handshake.Recommendations
Update Erlang/OTP to version 27.3.4.15 or later.
Update Erlang/OTP to version 28.5.0.4 or later.
Update Erlang/OTP to version 29.0.4 or later.
Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Erlang/Otp