CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in unordered form (A issues B, B issues A), the issuer lookup alternates between the two certificates and the pair of functions recurses indefinitely, growing the call stack and chain accumulator without bound. An unauthenticated remote attacker can send a crafted certificate chain in a TLS or DTLS Certificate handshake message to exhaust available memory and crash the BEAM node. Only a TCP connection and a partial handshake are required; no authentication or completed handshake is needed, and both TLS/DTLS servers and clients are affected when processing peer certificate messages. This issue affects OTP from OTP 23.2 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 10.2 before 11.7.4, 11.6.0.4 and 11.2.12.11.

• CWE-674

• https://cna.erlef.org/cves/CVE-2026-58227.html
• https://github.com/erlang/otp/commit/0307bff2c72b685c6bd952daaac6bd661c247d62
• https://github.com/erlang/otp/commit/241d43703989fec4b6bf637beaeb366d92dcc4c2
• https://github.com/erlang/otp/commit/7db64720177961e04545681480d691c4be81c54d
• https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw
• https://osv.dev/vulnerability/EEF-CVE-2026-58227
• https://www.erlang.org/doc/system/versions.html#order-of-versions

Published

Jul 27, 2026

Last Modified

Jul 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58216An out-of-bounds read flaw was found in Samba's Kerberos Key…5.3
• CVE-2026-58218A flaw was found in Samba's internal DNS server where unauth…5.3
• CVE-2026-5822Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-58222A security flaw combining LDAP filter injection and improper…8.8
• CVE-2026-58225SQL Injection vulnerability in elixir-ecto postgrex allows a…2.1
• CVE-2026-58226Inefficient Algorithmic Complexity vulnerability in elixir-m…8.7
• CVE-2026-58228Cross-site scripting vulnerability in phoenixframework phoen…5.1
• CVE-2026-58229Allocation of resources without limits vulnerability in elix…8.2
• CVE-2026-5823A weakness has been identified in itsourcecode Construction …6.3
• CVE-2026-58233SAP Change and Transport System Attach Tool (ctsattach) allo…7.6
• CVE-2026-5824A security vulnerability has been detected in code-projects …7.3
• CVE-2026-58246SAP NetWeaver Application Server for ABAP and ABAP Platform …4.3