Allocation of Resources Without Limits or Throttling in Erlang OTP - CVE-2026-59251

Vulnerability identifier: #VU146821

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-59251

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in certificate path validation when processing a crafted certificate chain during the TLS handshake. A remote attacker can send a specially crafted certificate chain to cause a denial of service.

Any application using TLS certificate path validation through the ssl functionality or direct calls to public_key:pkix_path_validation/3 is affected.

Erlang OTP
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
erlang26-debugsource
erlang26-et-src
erlang26-jinterface-src
erlang26
erlang26-dialyzer
erlang26-observer
erlang26-debuginfo
erlang26-src
erlang26-observer-src
erlang26-wx-debuginfo
erlang26-diameter
erlang26-doc
erlang26-epmd-debuginfo
erlang26-dialyzer-debuginfo
erlang26-debugger-src
erlang26-reltool
erlang26-reltool-src
erlang26-debugger
erlang26-et
erlang26-wx
erlang26-diameter-src
erlang26-dialyzer-src
erlang26-wx-src
erlang26-jinterface
erlang26-epmd
erlang (Debian package)

Install security update from vendor's website.

Erlang OTP - addressed in versions 17.0, 27.3.4.15, 28.5.0.4, 29.0.4
erlang26-debugsource - update to 26.2.1-150300.7.28.1
erlang26-et-src - update to 26.2.1-150300.7.28.1
erlang26-jinterface-src - update to 26.2.1-150300.7.28.1
erlang26 - update to 26.2.1-150300.7.28.1
erlang26-dialyzer - update to 26.2.1-150300.7.28.1
erlang26-observer - update to 26.2.1-150300.7.28.1
erlang26-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-src - update to 26.2.1-150300.7.28.1
erlang26-observer-src - update to 26.2.1-150300.7.28.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-diameter - update to 26.2.1-150300.7.28.1
erlang26-doc - update to 26.2.1-150300.7.28.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-debugger-src - update to 26.2.1-150300.7.28.1
erlang26-reltool - update to 26.2.1-150300.7.28.1
erlang26-reltool-src - update to 26.2.1-150300.7.28.1
erlang26-debugger - update to 26.2.1-150300.7.28.1
erlang26-et - update to 26.2.1-150300.7.28.1
erlang26-wx - update to 26.2.1-150300.7.28.1
erlang26-diameter-src - update to 26.2.1-150300.7.28.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.28.1
erlang26-wx-src - update to 26.2.1-150300.7.28.1
erlang26-jinterface - update to 26.2.1-150300.7.28.1
erlang26-epmd - update to 26.2.1-150300.7.28.1
erlang (Debian package) - update to 1:27.3.4.1+dfsg-1+deb13u3

• https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352

• Debian update for erlang
• Multiple vulnerabilities in Erlang OTP
• SUSE update for erlang26