Erlang/OTP DoS via Exponential Certificate Policy Tree (CVE-2023-0464)

Vulnerability Overview Vulnerability Name: Denial of Service via Exponential Certificate Policy Tree Growth CVE ID: CVE-2023-0464 CVSS v4 Base Metrics: 8.7 / 10 Description: A TLS peer can cause excessive CPU and memory consumption on a remote BEAM node by sending a specially crafted certificate chain during the TLS handshake. Since each certificate declares multiple certificate policies, the policy tree grows exponentially (M^N), where M is the number of policies per certificate and N is the chain depth. These schedulers can exhaust memory without any authentication required. Scope of Impact Affected Versions: OTP: >= 26.2 public_key (OTP): >= 1.15 Affected Systems: Any application using for TLS that performs certificate path verification, including (invoked as ). The same vulnerability class is associated with CVE-2023-0464 (OpenSSL). Remediation Patch Versions: OTP: 29.0.4, 28.5.0.4, 27.3.4.15 public_key (OTP): 1.21.4, 1.20.3.4, 1.17.1.5 Mitigation Measures: No configuration-level mitigations are available. Partial mitigations include: - Connection timeouts to limit handshake duration. - OS-level resource limits (cgroups, ulimit). - Rate limiting incoming TLS connections. Affected/Unaffected Versions Introduced in OTP 26.2 ( , ). The policy tree grows unconditionally during path verification—there is no option to enable or disable it. All OTP versions from 26.2 onwards are affected (26.2.x, 27.x, 28.x, 29.x). The option was added in (OTP 27.0), but it only controls the final policy execution check, not tree construction. Versions greater than or equal to one of the listed patch versions are unaffected. See the OTP versioning scheme. Acknowledgements Thanks to Lukas Backstrom of Erlang Solutions for discovering and responsibly disclosing this vulnerability to the Erlang/OTP project.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP DoS via Exponential Certificate Policy Tree (CVE-2023-0464)

More from this source