Allocation of Resources Without Limits or Throttling in Erlang OTP - CVE-2026-59251

Vulnerability identifier: #VU146821

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-59251

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in certificate path validation when processing a crafted certificate chain during the TLS handshake. A remote attacker can send a specially crafted certificate chain to cause a denial of service.

Any application using TLS certificate path validation through the ssl functionality or direct calls to public_key:pkix_path_validation/3 is affected.

Erlang OTP
SUSE Linux Enterprise Server 15 SP6
Debian Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Ubuntu
Server Applications Module
openSUSE Leap
Fedora
erlang26-epmd
erlang26-et-src
erlang26-jinterface-src
erlang26
erlang26-dialyzer
erlang26-observer
erlang26-debuginfo
erlang26-src
erlang26-observer-src
erlang26-wx-debuginfo
erlang26-diameter
erlang26-doc
erlang26-epmd-debuginfo
erlang26-dialyzer-debuginfo
erlang26-debugsource
erlang26-jinterface
erlang26-wx-src
erlang26-dialyzer-src
erlang26-diameter-src
erlang26-wx
erlang26-debugger
erlang26-reltool-src
erlang26-reltool
erlang26-debugger-src
erlang26-et
erlang
erlang27-reltool
erlang27-debugsource
erlang27-dialyzer-src
erlang27
erlang27-epmd
erlang27-diameter-src
erlang27-debuginfo
erlang27-dialyzer
erlang27-reltool-src
erlang27-dialyzer-debuginfo
erlang27-src
erlang27-jinterface-src
erlang27-jinterface
erlang27-epmd-debuginfo
erlang27-diameter
erlang (Ubuntu package)
erlang (Debian package)

Install security update from vendor's website.

Erlang OTP - addressed in versions 27.3.4.15, 28.5.0.4, 29.0.4
erlang26-epmd - update to 26.2.1-150300.7.28.1
erlang26-et-src - update to 26.2.1-150300.7.28.1
erlang26-jinterface-src - update to 26.2.1-150300.7.28.1
erlang26 - update to 26.2.1-150300.7.28.1
erlang26-dialyzer - update to 26.2.1-150300.7.28.1
erlang26-observer - update to 26.2.1-150300.7.28.1
erlang26-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-src - update to 26.2.1-150300.7.28.1
erlang26-observer-src - update to 26.2.1-150300.7.28.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-diameter - update to 26.2.1-150300.7.28.1
erlang26-doc - update to 26.2.1-150300.7.28.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-debugsource - update to 26.2.1-150300.7.28.1
erlang26-jinterface - update to 26.2.1-150300.7.28.1
erlang26-wx-src - update to 26.2.1-150300.7.28.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.28.1
erlang26-diameter-src - update to 26.2.1-150300.7.28.1
erlang26-wx - update to 26.2.1-150300.7.28.1
erlang26-debugger - update to 26.2.1-150300.7.28.1
erlang26-reltool-src - update to 26.2.1-150300.7.28.1
erlang26-reltool - update to 26.2.1-150300.7.28.1
erlang26-debugger-src - update to 26.2.1-150300.7.28.1
erlang26-et - update to 26.2.1-150300.7.28.1
erlang - update to 26.2.5.21-7.fc44
erlang27-reltool - update to 27.1.3-150300.7.7.1
erlang27-debugsource - update to 27.1.3-150300.7.7.1
erlang27-dialyzer-src - update to 27.1.3-150300.7.7.1
erlang27 - update to 27.1.3-150300.7.7.1
erlang27-epmd - update to 27.1.3-150300.7.7.1
erlang27-diameter-src - update to 27.1.3-150300.7.7.1
erlang27-debuginfo - update to 27.1.3-150300.7.7.1
erlang27-dialyzer - update to 27.1.3-150300.7.7.1
erlang27-reltool-src - update to 27.1.3-150300.7.7.1
erlang27-dialyzer-debuginfo - update to 27.1.3-150300.7.7.1
erlang27-src - update to 27.1.3-150300.7.7.1
erlang27-jinterface-src - update to 27.1.3-150300.7.7.1
erlang27-jinterface - update to 27.1.3-150300.7.7.1
erlang27-epmd-debuginfo - update to 27.1.3-150300.7.7.1
erlang27-diameter - update to 27.1.3-150300.7.7.1
erlang (Ubuntu package) - addressed in versions 1:16.b.3-dfsg-1ubuntu2.2+esm2, 1:18.3-dfsg-1ubuntu3.1+esm3, 1:20.2.2+dfsg-1ubuntu2+esm3, 1:22.2.7+dfsg-1ubuntu0.5+esm2, 1:24.2.1+dfsg-1ubuntu0.7, 1:25.3.2.8+dfsg-1ubuntu4.7, 1:27.3.4.6+dfsg-1ubuntu0.1
erlang (Debian package) - update to 1:27.3.4.1+dfsg-1+deb13u3

• https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352

• Debian update for erlang
• Multiple vulnerabilities in Erlang OTP
• SUSE update for erlang26
• Fedora 44 update for erlang
• Ubuntu update for erlang
• SUSE update for erlang27