CVE-2026-59251: 
CBL Mariner 脆弱性の分析と軽減

CVE-2026-59251 is a Denial of Service vulnerability in Erlang/OTP's public_key library caused by unbounded certificate policy tree growth during X.509 path validation. A remote unauthenticated attacker can crash the entire BEAM VM by sending a crafted certificate chain during a TLS handshake. Affected versions include Erlang/OTP from 26.2 through 29.x (specifically public_key versions 1.15 through pre-patch), with patched versions being OTP 29.0.4, 28.5.0.4, and 27.3.4.15. The vulnerability was published on July 27, 2026, and was responsibly disclosed by Lukas Backström at Erlang Solutions. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Red Hat).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in lib/public_key/src/pubkey_policy_tree.erl. During RFC 5280 certificate policy processing in public_key:pkix_path_validation/3, the functions pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 extend the policy tree per policy per certificate without any upper bound, causing exponential growth on the order of M^K nodes (M = policies per certificate, K = chain depth). A modest chain with many policies per certificate is sufficient to pin all BEAM schedulers and exhaust node memory, taking down the entire VM. The attack surface covers any incoming or outgoing TLS connection that validates the peer's certificate chain — the default behavior for SSL/TLS clients and mutual-TLS servers — requiring no authentication or special privileges. This is the same vulnerability class as CVE-2023-0464 (OpenSSL's X509_verify_cert policy tree DoS) (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in complete denial of service of the affected Erlang/OTP node: BEAM schedulers are pinned and system memory is exhausted, causing the entire VM to crash. There is no confidentiality or integrity impact, but availability impact is total for the vulnerable node. Any application using Erlang's ssl library for TLS — including those calling public_key:pkix_path_validation/3 directly — is affected, which encompasses a broad range of Erlang/Elixir-based services such as RabbitMQ, ejabberd, and other BEAM-based infrastructure (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is automatable (NVD SSVC: automatable=yes) and requires no authentication, no user interaction, and no special preconditions beyond the ability to initiate or respond to a TLS handshake. The EPSS score is 0.0026 (approximately 0.26%), reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection is available via Nessus plugins 330394 and 331346 (Feedly).

1. Identify target: Locate a network-accessible service running on Erlang/OTP 26.2–29.x that performs TLS certificate path validation (e.g., a TLS server with mutual authentication, or any TLS client that validates server certificates).
2. Craft malicious certificate chain: Generate a self-signed or CA-signed X.509 certificate chain where each certificate in the chain contains a large number of certificate policy OIDs (e.g., 10+ policies per certificate) in the certificatePolicies extension, optionally combined with policyMappings extensions to amplify cross-references.
3. Initiate TLS handshake: Connect to the target service and present the crafted certificate chain during the TLS handshake (for mutual-TLS servers) or act as a malicious TLS server to a connecting Erlang/OTP client.
4. Trigger exponential growth: The vulnerable pubkey_policy_tree:add_leaves/2 and pubkey_policy_tree:add_leaf_siblings/2 functions process each policy per certificate without bounds, causing the policy tree to grow as M^K nodes.
5. Crash the VM: Memory exhaustion and scheduler pinning cause the entire BEAM VM to crash, taking down all services hosted on that node (GitHub Advisory, Red Hat Bugzilla).

• Network: Unusual or repeated TLS handshake attempts from a single source IP that do not complete normally; connections presenting certificates with abnormally large numbers of policy OIDs in the certificatePolicies extension.
• Process: BEAM VM process consuming rapidly increasing memory during TLS handshake processing; all BEAM scheduler threads at 100% CPU utilization; Erlang node becoming unresponsive or crashing.
• Logs: Erlang crash dumps (erl_crash.dump) generated unexpectedly; OOM (out-of-memory) kernel messages coinciding with TLS connection attempts; SSL/TLS handshake timeout or failure logs at high frequency.
• System: Sudden spike in system memory consumption followed by process termination; OS-level OOM killer events targeting the BEAM process.

Upgrade to one of the patched Erlang/OTP versions: OTP 29.0.4, OTP 28.5.0.4, or OTP 27.3.4.15 (corresponding to public_key versions 1.21.4, 1.20.3.4, and 1.17.1.5 respectively). The fix adds a monotonic node counter capped at 1,000 policy tree nodes, rejecting chains that exceed this limit with {bad_cert, policy_tree_exceeded} (GitHub Commit). No configuration-level workaround exists to disable the vulnerable code path. Partial mitigations for environments that cannot immediately patch include: implementing TLS handshake timeouts, applying OS-level resource limits (cgroups/ulimit) on the BEAM process, and rate-limiting incoming TLS connections (GitHub Advisory).

The vulnerability was credited to Lukas Backström at Erlang Solutions for responsible disclosure to the Erlang/OTP project. Security coverage appeared on SecurityOnline.info and was tracked by INCIBE-CERT. The vulnerability has been noted as belonging to the same class as OpenSSL's CVE-2023-0464, drawing comparisons to the broader pattern of certificate policy tree DoS vulnerabilities across TLS implementations (GitHub Advisory, SecurityOnline).