Unauthenticated DoS in Erlang/OTP asn1 OBJECT IDENTIFIER Decoder (CVE-2026-65634)
CVSS 4.0
8.2high
EPSS
—
Published
()
Modified
AI analysis
A remote unauthenticated denial of service vulnerability exists in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder. It causes quadratic computational work during TLS handshake when a crafted OID is sent, potentially crashing services. This flaw affects OTP and asn1 versions prior to specific fixes, and can be triggered during certificate parsing. Attackers can exploit this to crash services without authentication, impacting TLS clients and mutual-TLS servers. Current exploitation status is unknown as no public PoC is known.
What to do: Upgrade to OTP 27.3.4.18, 28.5.0.7, and 29.1.1 to mitigate the vulnerability. Implement strict TLS certificate validation and disable TLS handshake parsing in vulnerable components. Monitor OTP versions for known vulnerabilities.
Affected
Erlang OTP
OTP 17.0 before 27.3.4.18, 28.5.0.7, and 29.1.1
Erlang asn1
asn1 3.0 before 5.3.4.3, 5.4.3.1, and 5.5.2
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rtt_ber:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_ber.erl and the equivalent PER helper asn1rtt_per_common:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_per_common.erl accumulate a base-128 subidentifier into an unbounded integer using (Av bsl 7) + H per continuation byte. Each shift and addition on the growing accumulator is linear in the number of bits already accumulated, giving quadratic total work in the size of a single subidentifier. The JER helper asn1rtt_jer:json2oid/1 in lib/asn1/src/asn1rtt_jer.erl exhibits the same class of unbounded-integer parsing when decoding a dot-separated OID from JSON. A DER-encoded OBJECT IDENTIFIER with one very large arc (approximately 262 KB of continuation bytes) consumes roughly 13 seconds of CPU on typical hardware. The vulnerable decoder is generated into every ASN.1 module that contains an OBJECT IDENTIFIER, including OTP-PUB-KEY which is reached during X.509 certificate parsing via public_key:pkix_decode_cert/2. This decoder runs before any signature or trust chain verification, so any Erlang service that parses peer TLS certificates is exposed: the default for TLS clients (which always parse the server certificate) and for mutual-TLS servers (which parse client certificates). This vulnerability is associated with program files lib/asn1/src/asn1rtt_ber.erl, lib/asn1/src/asn1rtt_per_common.erl and lib/asn1/src/asn1rtt_jer.erl and program routines asn1rtt_ber:dec_subidentifiers/3, asn1rtt_per_common:dec_subidentifiers/3 and asn1rtt_jer:json2oid/1. This issue affects OTP from OTP 17.0 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to asn1 from 3.0 before 5.3.4.3, 5.4.3.1, and 5.5.2. Whether OTP before OTP 17.0, corresponding to asn1 before 3.0, is affected is unknown.
Canadian Cyber Centre warns Erlang/OTP is affected by CVE-2026-65634 and CVE-2026-89422 and urges updates.
The Canadian Centre for Cyber Security published advisory AV26-948 stating that Erlang/OTP is affected by vulnerabilities tracked as CVE-2026-65634 and CVE-2026-89422. The notice lists multiple OTP release lines and commits that are fixed only in later builds, including 27.3.4.18, 28.5.0.7, and 29.1.1. Administrators are urged to review the linked erlang/otp GitHub security advisories and apply updates. No exploitation is described.