EEF-CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

Summary The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl\certificate:handle\incomplete\chain/5, the received chain is passed to ssl\certificate:build\certificate\chain/5, which walks issuer...

CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227

CVE-2026-58227 : In Erlang/OTP, the ssl certificate chain reconstruction during TLS/DTLS handshakes can fail to detect cycles, causing unbounded recursion when peers supply cross-signed chains (A→B and B→A). The missing cycle detection and depth limit in ssl_certificate:build_certificate_chain/5 ...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

@0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1), @514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, <=0.0.64) +729 more potentially affected by CVE-2026-55968 via thrift (>=0.6.0-1, <=0.23.0)

thrift NPM version =0.6.0-1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.0-dev, =1.0.0, =0.9.0, =0.3.0, =0.0.1, =0.2.0, =0.2.0, =0.1.0, =1.0.0-beta.1, =1.0.0-beta.6 and more Source cves: CVE-2026-55968 Source advisory: SNYK:JS-THRIFT-18388780...

isms-builder v1.37.0

ISMS Builder Self-hosted Information Security Management System — open source, no cloud required ⚠️ Security Warning: Fake repositories and copies distributing malware ISMS Builder has no packaged "releases", installers, or downloadable ZIP files — the only legitimate source is this repository,...

TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments

Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle East. The intrusions have resulted in the deployment of previously unreported malware families dubbed TELESHIM, MIXEDKEY, and BINDCLOAK,...

GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. "The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldo...

RedAmon 6.2.2

An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merged patch, with human oversight at every...

PT-2026-64989

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 23.2 through 27.3.4.14 Erlang/OTP version 28.5.0.3 Erlang/OTP version 29.0.3 Description The ssl application fails to detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake...

PT-2026-64994

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 26.2 through 27.3.4.14 Erlang/OTP versions 28.0 through 28.5.0.3 Erlang/OTP versions 29.0 through 29.0.3 public key versions 1.15 through 1.17.1.4 public key versions 1.20 through 1.20.3.3 public key versions 1.21 through...

Erlang/OTP -- TLS denial of service using invalid certificate chains

https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw reports: A TLS/DTLS peer can crash the remote node by sending a certificate chain containing two mutually cross-signed certificates in unordered form. When the receiving side attempts to build a valid chain path, it enters...

bromure agentic-coding-v4.5.2

Bromure Secure, ephemeral computing in disposable Linux VMs on macOS. → Full details, screenshots, and downloads at bromure.io This repo ships two sibling apps, both built on Apple's Virtualization.framework: Bromure — every browser session runs in a throwaway Linux VM. Close the window, the VM i...

muad-dib v2.11.179

Installation | Usage | Features | VS Code | CI/CD Version francaise Why MUAD'DIB? npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond. MUAD'DIB combines 22 parallel scanners 277 detection rules, a...

Exploit for Deserialization of Untrusted Data in Dataease

DataEase — Unauthenticated RCE via a 4-vulnerability chain CV...

UBUNTU-CVE-2026-64478

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the...

sbomlyze v0.3.5

sbomlyze git diff for your SBOM. Compare two Software Bills of Materials and see what changed between builds, versions, and releases. sbomlyze compares component hashes, not only version strings. When an attacker swaps a package without bumping its version, sbomlyze flags it. Generators and...

IAGA-Sentinel v2.0.0

IAGA Sentinel The EU AI Act conformity evidence layer for AI agents. Cryptographically signed, replay-verifiable evidence of every action an agent routes through it, structured to support AI Act Article 12 record-keeping and Annex IV documentation. Documentation · Quickstart · Autonomous agent...