# CVE-2026-65634

ASN.1 OID parser DoS in Erlang/OTP during TLS certificate parsing.

- Page: https://www.vulneraibility.com/cve/CVE-2026-65634
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.27% (percentile 18.6)
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2026-09-22)
- Weakness: CWE-407
- Also known as: GHSA-qghx-23m5-r55m
- Published: 2026-09-22

## Affected versions

- Erlang OTP: affected >= 17.0 and < *; >= 3.0 and < *; >= 84adefa331c4159d432d22840663c38f155cd4c1 and < 0fe2c02fdc06fab1c63be9db1a7456993d20f838

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote unauthenticated denial-of-service via crafted OBJECT IDENTIFIER in TLS handshake causing CPU exhaustion and service outages.

## Action

Immediate action required

## Recommendation

Upgrade OTP to fixed releases or apply vendor patches immediately.

## References

- [advisory] https://github.com/erlang/otp/security/advisories/GHSA-qghx-23m5-r55m
- [other] https://cna.erlef.org/cves/CVE-2026-65634.html
- [other] https://osv.dev/vulnerability/EEF-CVE-2026-65634
- [other] https://www.erlang.org/doc/system/versions.html#order-of-versions
- [patch] https://github.com/erlang/otp/commit/0fe2c02fdc06fab1c63be9db1a7456993d20f838

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.