A resource exhaustion vulnerability in the Erlang/OTP public_key module allows unauthenticated remote attackers to cause a denial of service.

This is a resource allocation issue (CWE-770) occurring during certificate path validation, where the system fails to apply appropriate limits when processing crafted X.509 data, enabling an unauthenticated remote attacker to trigger a crash or resource exhaustion.

The CVSS score of 8.7 highlights the severity of this issue, as it is fully automatable and does not require authentication. Successful exploitation can lead to a denial of service, effectively taking down systems that rely on the Erlang/OTP public_key module for secure communications or certificate validation.

Immediate Action: Apply the vendor-provided security patches to all affected Erlang/OTP installations.

Proactive Monitoring: Monitor system resource usage, specifically memory and CPU, during certificate validation processes and look for signs of unexpected service restarts.

Compensating Controls: Use strict certificate validation policies and ensure that incoming certificate chains are scanned or limited in size at the infrastructure level before being processed by the Erlang application.

Public Exploit Available: Unknown

This vulnerability is critical due to its potential for easy, remote exploitation without authentication. Administrators should prioritize upgrading to the latest patched version of Erlang/OTP to ensure robust handling of certificate validation and prevent denial of service attacks.