PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59251 Erlang CVE debrief

CVE-2026-59251 is a high-severity vulnerability in Erlang/OTP's public_key certificate path validation. A remote unauthenticated attacker can cause a denial of service by sending a crafted X.509 certificate chain during the TLS handshake. The vulnerability is due to the lack of limits in the certificate policy tree maintained by pubkey_policy_tree, which can grow exponentially with the number of policies per certificate and certificates in the chain.

Vendor
Erlang
Product
OTP
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-07-27
Advisory published
2026-07-27
Advisory updated
2026-07-27

Who should care

Organizations using Erlang/OTP versions prior to OTP 29.0.4, OTP 28.5.0.4, or OTP 27.3.4.15 should prioritize patching this vulnerability. This includes users of Erlang/OTP in various industries, such as telecommunications, finance, and healthcare, who rely on secure communication protocols.

Technical summary

The vulnerability is caused by the unbounded growth of the certificate policy tree in public_key:pkix_path_validation/3. This can lead to a denial of service when a certificate chain with many policies per certificate is presented. The affected code is located in lib/public_key/src/pubkey_policy_tree.erl, specifically in the routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2.

Defensive priority

High

Recommended defensive actions

  • Apply the patches provided by the vendor for OTP 29.0.4, OTP 28.5.0.4, or OTP 27.3.4.15.
  • Restrict the number of policies per certificate in certificate chains.
  • Implement additional monitoring and logging to detect potential exploitation attempts.
  • Consider using compensating controls, such as rate limiting or IP blocking, to mitigate the attack surface.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-27T16:18:03.517Z and has been modified since then. The NVD entry is currently being processed. The vulnerability is associated with CWE-770. The vendor has provided patches for the affected versions.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T16:18:03.517Z and has been modified since then. The NVD entry is currently being processed.