CVE-2026-59251: erlang/otp from 26.2 (inclusive), before 27.3.4.15 (exclusive), from 28.0 (inclusive), before 28.5.0.4 (exclusive)…

Affected technology

erlang/otp · from 26.2 (inclusive), before 27.3.4.15 (exclusive)
erlang

erlang/otp · from 28.0 (inclusive), before 28.5.0.4 (exclusive)
erlang

erlang/otp · from 29.0 (inclusive), before 29.0.4 (exclusive)
erlang

erlang/public key · from 1.15 (inclusive), before 1.17.1.5 (exclusive)
erlang

erlang/public key · from 1.18 (inclusive), before 1.20.3.4 (exclusive)
erlang

erlang/public key · from 1.21 (inclusive), before 1.21.4 (exclusive)
erlang

OTP · 1.15 to before *; status changes: 1.21.4 — unaffected, 1.20.3.4 — unaffected, 1.17.1.5 — unaffected
Erlang

OTP · 26.2 to before *; status changes: 29.0.4 — unaffected, 28.5.0.4 — unaffected, 27.3.4.15 — unaffected, 9d1dda7bad5a64b58c10a1554751689e94131a73 to before *; status changes: f8580fc117098c08165f46c26fd0750c5cfb2a90 — unaffected, f04c6bba38de1cf1b1836a7d9a9fbe239bd939e8 — unaffected
Erlang

Component: pubkey_policy_tree
Function: pubkey_policy_tree:add_leaves/2, pubkey_policy_tree:add_leaf_siblings/2
File: src/pubkey_policy_tree.erl, lib/public_key/src/pubkey_policy_tree.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A remote unauthenticated attacker can cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.