CVE-2026-58227
Erlang/OTP crashes on a TLS certificate chain of two mutually cross-signed certificates
Technology
Erlang/OTP
CVSS Score
7.5 / 10.0
Affected Versions
OTP 23.2 and later, before 27.3.4.15, 28.5.0.4 and 29.0.4 (ssl)
Upstream Fix
OTP 27.3.4.15, 28.5.0.4, 29.0.4
Published
July 27, 2026
OSSeva Coverage
Fixed upstream
Description
When the ssl application rebuilds an incomplete peer certificate chain it has no cycle detection or depth limit. Two certificates that sign each other, sent unordered, make it recurse until the node runs out of memory and crashes. No authentication or completed handshake is needed, and clients and servers are both affected. NVD scores it 7.5; the EEF's CVSS 4.0 score is 8.7.
Is your Erlang/OTP deployment affected?
If you're running OTP 23.2 and later, before 27.3.4.15, 28.5.0.4 and 29.0.4 (ssl), you need this patch. Book a discovery call to get covered.
View Erlang/OTP coverage →Get a quote
Running Erlang/OTP OTP 23.2 and later, before 27.3.4.15, 28.5.0.4 and 29.0.4 (ssl)?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?