PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59251 Erlang CVE debrief

CVE-2026-59251 is a high-severity vulnerability in Erlang/OTP's public_key certificate path validation. A remote unauthenticated attacker can cause a denial of service by sending a crafted X.509 certificate chain during the TLS handshake. The vulnerability is due to the lack of limits in the certificate policy tree maintained by pubkey_policy_tree, which can grow exponentially with the number of policies per certificate and certificates in the chain.

Vendor
Erlang
Product
OTP
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-08-10
Advisory published
2026-07-27
Advisory updated
2026-08-10

Who should care

Organizations using Erlang/OTP versions prior to OTP 29.0.4, OTP 28.5.0.4, or OTP 27.3.4.15 should prioritize patching this vulnerability. This includes users of Erlang/OTP in various industries, such as telecommunications, finance, and healthcare, who rely on secure communication protocols.

Technical summary

The vulnerability is caused by the unbounded growth of the certificate policy tree in public_key:pkix_path_validation/3. This can lead to a denial of service when a certificate chain with many policies per certificate is presented. The affected code is located in lib/public_key/src/pubkey_policy_tree.erl, specifically in the routines pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2.

Defensive priority

High

Recommended defensive actions

  • Apply the patches provided by the vendor for OTP 29.0.4, OTP 28.5.0.4, or OTP 27.3.4.15.
  • Restrict the number of policies per certificate in certificate chains.
  • Implement additional monitoring and logging to detect potential exploitation attempts.
  • Consider using compensating controls, such as rate limiting or IP blocking, to mitigate the attack surface.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-27T16:18:03.517Z and has been modified since then. The NVD entry is currently being processed. The vulnerability is associated with CWE-770. The vendor has provided patches for the affected versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-59251 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-59251

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-59251 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-59251

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-59251.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/erlang/otp/commit/f04c6bba38de1cf1b1836a7d9a9fbe239bd939e8

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/erlang/otp/commit/f8580fc117098c08165f46c26fd0750c5cfb2a90

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-59251

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://www.erlang.org/doc/system/versions.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.