Is CVE-2026-59251 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59251 being exploited in the wild.

How severe is CVE-2026-59251?

Informational severity, with a CVSS score of 8.7, published 27 July 2026.

Which products and versions are affected?

Erlang OTP 26.2 before 29.0.4, 28.5.0.4, and 27.3.4.15; Erlang public_key 1.15 before 1.21.4, 1.20.3.4, and 1.17.1.5.

Is there a fix for CVE-2026-59251?

A patch was published on 2026-07-23: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59251 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59251?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59251: Erlang OTP denial of service in public_key certificate path validation

CVE-2026-59251 · Severity: info · CVSS 8.7 · Published 2026-07-27

A vulnerability in the Erlang/OTP public_key library can allow a remote attacker to crash the entire Erlang Virtual Machine (VM). By providing a specially crafted security certificate during a standard encrypted connection (TLS) handshake, an attacker can force the system to exhaust its memory and processing power. This affects any application using Erlang's built-in SSL/TLS capabilities, including web servers and clients, potentially leading to a complete service outage.

Quick answers

Is CVE-2026-59251 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59251 being exploited in the wild.
How severe is CVE-2026-59251?: Informational severity, with a CVSS score of 8.7, published 27 July 2026.
Which products and versions are affected?: Erlang OTP 26.2 before 29.0.4, 28.5.0.4, and 27.3.4.15; Erlang public_key 1.15 before 1.21.4, 1.20.3.4, and 1.17.1.5.
Is there a fix for CVE-2026-59251?: A patch was published on 2026-07-23: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59251 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59251?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the RFC 5280 policy processing logic within Erlang's public_key library, specifically in the pubkey_policy_tree module. When validating an X.509 certificate chain, the functions add_leaves/2 and add_leaf_siblings/2 can cause the policy tree to grow exponentially (O(M^K)) if a chain contains many policies per certificate. An unauthenticated remote attacker can exploit this during a TLS handshake by presenting a crafted certificate chain, leading to BEAM scheduler pinning and memory exhaustion. This is a resource exhaustion vulnerability (CWE-770) similar to historical policy tree DoS issues in OpenSSL. Patches have been released in OTP versions 29.0.4, 28.5.0.4, and 27.3.4.15 which introduce a monotonic node counter to cap tree growth.

Affected products

Erlang OTP 26.2 before 29.0.4, 28.5.0.4, and 27.3.4.15
Erlang public_key 1.15 before 1.21.4, 1.20.3.4, and 1.17.1.5

Timeline

2026-07-16: other: Fix authored
2026-07-23: patched: Fix committed to repository
2026-07-27: advisory: NVD and CNA advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.