CVE-2026-65634

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

CVE-2026-65634

CVE-2026-65634 is a quadratic-complexity CPU denial-of-service vulnerability in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder. The root cause is that asn1rtt_ber:dec_subidentifiers/3, asn1rtt_per_common:dec_subidentifiers/3, and asn1rtt_jer:json2oid/1 accumulate a base-128 subidentifier into an u...