A remote, unauthenticated denial of service vulnerability in Erlang/OTP, caused by inefficient ASN.1 parsing, poses a significant risk to the availability of services utilizing TLS connections.

This is an inefficient algorithmic complexity issue (CWE-407) within the ASN.1 OBJECT IDENTIFIER decoder. A remote, unauthenticated attacker can supply a specially crafted OID during a TLS handshake, forcing the application to perform excessive CPU calculations that result in a denial of service.

Successful exploitation of this vulnerability can lead to significant service disruption and system unavailability. Because the vulnerable code is invoked during TLS certificate parsing, any Erlang-based service that handles incoming TLS connections is potentially exposed to this attack. With a CVSS score of 8.2, this high-severity flaw requires urgent attention to prevent attackers from exhausting system resources and causing prolonged downtime for critical infrastructure.

Immediate Action: Update Erlang/OTP to version 27.3.4.18, 28.5.0.7, 29.1.1, or later, as these versions contain the necessary security patches for the ASN.1 decoder.

Proactive Monitoring: Monitor system CPU utilization and TLS handshake logs for unusual spikes or errors that correlate with connection attempts from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall or an edge load balancer capable of inspecting and validating incoming TLS traffic to filter out malformed certificates or OID structures before they reach the backend Erlang service.

Public Exploit Available: Unknown.

Given the critical role of TLS in securing network communications, the potential for widespread service disruption is high. Administrators should treat this vulnerability with urgency and prioritize the deployment of the vendor-supplied updates across all affected Erlang environments. If immediate patching is not feasible, implement strict network-level access controls to limit exposure to the vulnerable services.