Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-58227: The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain

39
Routine
HIGH 7.5REMOTEUPGRADEUPGRADE

CVE-2026-58227 is a high-severity flaw (CVSS 7.5) affecting erlang\/otp, erlang\/ssl. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:build_certificate_chain/5, which walks issuer relationships via ssl_certificate:do_certificate_chain/7 with no cycle detection and no depth limit. When the peer supplies two mutually cross-signed certificates in u

Why this priority

  • High severity
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score7.5 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance0.4% (top 68%)
CISA exploited listNo
WeaknessCWE-674
Published2026-07-27
Last modified2026-10-24
Publisher (CNA): EEF · Vendor: erlang

Share: LinkedIn · X · Reddit

Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

erlang erlang\/otp UPGRADE
Affected: >= 23.2 and < 27.3.4.15 · >= 28.0 and < 28.5.0.4 · >= 29.0 and < 29.0.4
Fixed in: 27.3.4.15, 28.5.0.4, 29.0.4
Safe to downgrade to: a release before 23.2
1. Check installed version
apt-cache policy erlangotp || rpm -q erlangotp || erlangotp --version
2. UPGRADE to 27.3.4.15 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade erlangotp
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade erlangotp
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 23.2 (Debian / Ubuntu)
apt-cache madison erlangotp sudo apt install erlangotp=<VERSION_BEFORE_23.2> sudo apt-mark hold erlangotp
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list erlangotp sudo dnf downgrade erlangotp-<VERSION_BEFORE_23.2> sudo dnf versionlock add erlangotp
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
erlang erlang\/ssl UPGRADE
Affected: >= 10.2 and < 11.2.12.11 · >= 11.3 and < 11.6.0.4 · >= 11.7 and < 11.7.4
Fixed in: 11.2.12.11, 11.6.0.4, 11.7.4
Safe to downgrade to: a release before 10.2
1. Check installed version
apt-cache policy erlangssl || rpm -q erlangssl || erlangssl --version
2. UPGRADE to 11.2.12.11 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade erlangssl
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade erlangssl
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 10.2 (Debian / Ubuntu)
apt-cache madison erlangssl sudo apt install erlangssl=<VERSION_BEFORE_10.2> sudo apt-mark hold erlangssl
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list erlangssl sudo dnf downgrade erlangssl-<VERSION_BEFORE_10.2> sudo dnf versionlock add erlangssl
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora ELN · ntpd-rs · FIXED · 1.7.2-3.eln159 · FEDORA-2026-57e4a99310 · source
sudo dnf upgrade --advisory=FEDORA-2026-57e4a99310
Fedora 46 · moby-engine · FIXED · 29.9.2-2.fc46 · FEDORA-2026-4856be87b3 · source
sudo dnf upgrade --advisory=FEDORA-2026-4856be87b3
Ubuntu 20.04 · erlang · NOT AFFECTED
Ubuntu 22.04 · erlang · FIXED · 1:24.2.1+dfsg-1ubuntu0.7
sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:24.2.1+dfsg-1ubuntu0.7" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.04 · erlang · FIXED · 1:25.3.2.8+dfsg-1ubuntu4.7
sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:25.3.2.8+dfsg-1ubuntu4.7" && echo PATCHED || echo STILL-VULNERABLE
Debian 12 · erlang · NO FIX YET
Debian 13 · erlang · FIXED · 1:27.3.4.1+dfsg-1+deb13u3
sudo apt update && sudo apt install --only-upgrade erlang dpkg --compare-versions "$(dpkg-query -W -f='${Version}' erlang)" ge "1:27.3.4.1+dfsg-1+deb13u3" && echo PATCHED || echo STILL-VULNERABLE

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-58227?

erlang\/otp: upgrade to 27.3.4.15, 28.5.0.4, 29.0.4; erlang\/ssl: upgrade to 11.2.12.11, 11.6.0.4, 11.7.4. Exact commands for each OS are on this page.

Is CVE-2026-58227 being exploited?

CVE-2026-58227 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-58227 affect?

CVE-2026-58227 affects erlang\/otp, erlang\/ssl. Severity is high (CVSS 7.5). The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received chain is passed to ssl_certificate:bui

How urgent is CVE-2026-58227?

Priority 39/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.