CVE-2026-58227
Received Received - Intake

Infinite Recursion in Erlang/OTP SSL Certificate Chain Handling

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: EEF

Description
The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound. An unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS Certificate handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages. This issue affects OTP from OTP 23.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-58227
EUVD
EUVD-2026-49315

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
erlang otp From 23.2 (exc) to 29.0.4 (inc)
erlang otp From 28.5.0.4 (exc)
erlang otp From 27.3.4.15 (exc)
erlang ssl From 10.2 (exc) to 11.7.4 (inc)
erlang ssl From 11.6.0.4 (exc)
erlang ssl From 11.2.12.11 (exc)
erlang otp From 23.2 (inc) to 29.0.4 (exc)
erlang otp 28.5.0.4
erlang otp 27.3.4.15
erlang ssl From 10.2 (inc) to 11.7.4 (exc)
erlang ssl 11.6.0.4
erlang ssl 11.2.12.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Erlang/OTP ssl application failing to detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. When a peer sends two mutually cross-signed certificates, the system enters an infinite loop, exhausting memory and crashing the BEAM node.

Detection Guidance

This vulnerability may cause excessive memory usage or crashes during TLS/DTLS handshakes with peers sending malformed certificate chains. Monitor for BEAM node crashes or high memory consumption during TLS/DTLS operations. Check logs for incomplete handshake attempts or certificate chain processing errors.

Impact Analysis

An unauthenticated remote attacker can exploit this by sending a crafted certificate chain, causing a denial of service by crashing the affected system. Both TLS/DTLS servers and clients are vulnerable during peer certificate processing.

Compliance Impact

This vulnerability primarily impacts system availability by causing crashes due to memory exhaustion, which could lead to service disruptions. For compliance with standards like GDPR or HIPAA, such disruptions may violate requirements for data availability, integrity, and security. Organizations relying on vulnerable Erlang/OTP systems could face compliance risks if this DoS condition affects critical services handling sensitive data.

Mitigation Strategies

Upgrade Erlang/OTP to a patched version: OTP 29.0.4 or later, OTP 28.5.0.4 or later, or OTP 27.3.4.15 or later. Ensure ssl application versions are updated to 11.7.4 or later, 11.6.0.4 or later, or 11.2.12.11 or later.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58227. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart