Erlang/OTP public_key: unbounded certificate policy tree lets a TLS peer exhaust the BEAM node

Impact

During RFC 5280 policy processing in public_key:pkix_path_validation/3, the policy tree grows on the order of M^K for K certificates with M policies each. A modest crafted chain presented during a TLS handshake pins the BEAM schedulers and exhausts memory, taking down the whole Erlang VM and every service in it. Presenting a chain is the normal precondition of a handshake, so this reaches any OTP-based service that validates peer chains - the default for TLS clients and mutual-TLS servers. Datacenter-relevant OTP services (RabbitMQ, CouchDB, EMQX and similar message and coordination layers in a fleet) fail wholesale rather than dropping one connection.

Who can reach it

Anyone who can complete the start of a TLS handshake with an OTP service, or lure an OTP client into connecting outbound. Unauthenticated - the certificate is evaluated before authentication finishes.

What to do

Upgrade OTP to 29.0.4, 28.5.0.4 or 27.3.4.15 (public_key 1.21.4, 1.20.3.4, 1.17.1.5) and restart the affected BEAM services; for packaged products wait on the vendor rebuild. Mitigation short of patching means terminating TLS in front of the Erlang node or not validating untrusted chains, both of which change the trust model.

References

Related entries

• libssh2: malicious SSH server can corrupt the heap of any client opening an SFTP sessionCVE-2026-66032 · libssh2 sftp_open() (src/sftp.c double free)High
• libssh2: pre-auth integer underflow crashes any client that negotiates AES-GCMCVE-2026-66033 · libssh2 ssh2_cipher_crypt() (src/openssl.c AES-GCM length underflow)High
• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh
• Linux kernel (net/tls): When a BPF socket policy shrinks the plaintext after the ciphertext length was computed, kTLSCVE-2025-38608 · Linux kernel (net/tls)High
• Linux kernel io_uring zero-copy receive: desc->count underflow lets a recv overshoot its limitCVE-2025-40046 · Linux kernel io_uring/zcrx (desc->count double accounting in io_zcrx_recv_skb)High
• Linux kernel libceph: truncated monitor reply decodes stale bytes from the reused bufferCVE-2026-68433 · Linux kernel libceph (MON_GET_VERSION_REPLY decode bound)High