Denial of Service Vulnerability in Erlang/OTP Product for TLS Handshake

CVE-2026-65634

What is CVE-2026-65634?

An inefficiency in the OBJECT IDENTIFIER (OID) decoder within Erlang/OTP allows for remote unauthenticated attackers to exploit this flaw during the TLS handshake. By sending a specially crafted OID, attackers can trigger significant CPU usage, leading to denial of service. This vulnerability is particularly concerning for any Erlang service that parses peer TLS certificates, as it occurs before critical signature or trust chain verifications are applied. The vulnerable components reside in specific program files that manage OID decoding, which could impact various versions of Erlang/OTP.

References