CVE-2026-32144

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32144", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-03-10T22:37:29.212Z", "datePublished": "2026-04-07T12:28:00.767Z", "dateUpdated": "2026-11-11T19:24:15.856Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["pubkey_ocsp", "ssl_stapling"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/public_key/src/pubkey_ocsp.erl", "lib/ssl/src/ssl_stapling.erl"], "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.10", "status": "unaffected"}, {"at": "28.4.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "27.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["pubkey_ocsp"], "packageName": "public_key", "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/pubkey_ocsp.erl"], "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "1.17.1.2", "status": "unaffected"}, {"at": "1.20.3", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "1.16", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["ssl_stapling"], "packageName": "ssl", "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/ssl_stapling.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "11.2.12.7", "status": "unaffected"}, {"at": "11.5.4", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "11.2", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["pubkey_ocsp", "ssl_stapling"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/public_key/src/pubkey_ocsp.erl", "lib/ssl/src/ssl_stapling.erl"], "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0", "status": "unaffected"}, {"at": "ac7ff528be857c5d35eb29c7f24106e3a16d4891", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "601a012837ea0a5c8095bf24223132824177124d", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SSL/TLS must be configured with OCSP stapling enabled (e.g., <code>{stapling, staple}</code>), or the application must call <code>public_key:pkix_ocsp_validate/5</code> directly. OCSP stapling is disabled by default (<code>{stapling, no_staple}</code>).</p>"}, {"base64": false, "type": "text/markdown", "value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., `{stapling, staple}`), or the application must call `public_key:pkix_ocsp_validate/5` directly. OCSP stapling is disabled by default (`{stapling, no_staple}`)."}], "value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., {stapling, staple}), or the application must call public_key:pkix_ocsp_validate/5 directly. OCSP stapling is disabled by default ({stapling, no_staple})."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Igor Morgenstern / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Jakub Witczak"}, {"lang": "en", "type": "remediation reviewer", "value": "Ingela Anderton Andin"}], "datePublic": "2026-04-07T12:28:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.</p>\n<p>The OCSP response validation in <code>public_key:pkix_ocsp_validate/5</code> does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.</p>\n<p>This affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the <code>public_key:pkix_ocsp_validate/5</code> API directly are also affected, with impact depending on usage context.</p>\n<p>This vulnerability is associated with program files <code>lib/public_key/src/pubkey_ocsp.erl</code> and program routines <code>pubkey_ocsp:is_authorized_responder/3</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;27.0 before OTP&nbsp;27.3.4.10 and OTP&nbsp;28.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in `public_key:pkix_ocsp_validate/5` does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the `public_key:pkix_ocsp_validate/5` API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files `lib/public_key/src/pubkey_ocsp.erl` and program routines `pubkey_ocsp:is_authorized_responder/3`.\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.10 and OTP\u00a028.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4."}], "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.10 and OTP\u00a028.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4."}], "impacts": [{"capecId": "CAPEC-459", "descriptions": [{"lang": "en", "value": "CAPEC-459 Creating a Rogue Certification Authority Certificate"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.6, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:24:15.856Z"}, "references": [{"name": "OCSP designated-responder authorization bypass \u2014 missing signature verification (RFC 6960 \u00a74.2.2.2)", "tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm"}, {"name": "EEF CNA record for CVE-2026-32144", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-32144.html"}, {"name": "OSV record EEF-CVE-2026-32144", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32144"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Introducing commit 601a012 in erlang/otp", "tags": ["related"], "url": "https://github.com/erlang/otp/commit/601a012837ea0a5c8095bf24223132824177124d"}, {"name": "Fix commit 49033a6 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0"}, {"name": "Fix commit ac7ff52 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891"}], "source": {"discovery": "EXTERNAL"}, "title": "OCSP designated-responder authorization bypass via missing signature verification", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>For SSL users:</strong></p>\n<ul>\n<li>Do not enable OCSP validation setting (current default is <code>{stapling, no_staple}</code>)</li>\n<li>Use CRL-based revocation checking by setting the <code>{crl_check, true}</code> SSL option instead</li>\n</ul>\n<p><strong>For applications using <code>public_key:pkix_ocsp_validate/5</code> directly:</strong></p>\n<ul>\n<li>Pass <code>{is_trusted_responder_fun, Fun}</code> option with a function that validates trusted responder certificates</li>\n<li>Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)</li>\n</ul>"}, {"base64": false, "type": "text/markdown", "value": "**For SSL users:**\n\n* Do not enable OCSP validation setting (current default is `{stapling, no_staple}`)\n* Use CRL-based revocation checking by setting the `{crl_check, true}` SSL option instead\n\n**For applications using `public_key:pkix_ocsp_validate/5` directly:**\n\n* Pass `{is_trusted_responder_fun, Fun}` option with a function that validates trusted responder certificates\n* Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)"}], "value": "For SSL users:\n\n* Do not enable OCSP validation setting (current default is {stapling, no_staple})\n* Use CRL-based revocation checking by setting the {crl_check, true} SSL option instead\n\nFor applications using public_key:pkix_ocsp_validate/5 directly:\n\n* Pass {is_trusted_responder_fun, Fun} option with a function that validates trusted responder certificates\n* Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T13:15:14.355759Z", "id": "CVE-2026-32144", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T13:15:20.530Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat"}], "datePublic": "2026-04-07T12:28:00.767Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Erlang OTP public_key. This improper certificate validation vulnerability allows a remote attacker to bypass Online Certificate Status Protocol (OCSP) designated-responder authorization. The vulnerability stems from missing signature verification during OCSP response validation, enabling an attacker to forge responses that mark revoked certificates as valid. Consequently, clients may accept connections to compromised servers, potentially leading to the transmission of sensitive data."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "description": "Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-32144"}, {"name": "RHBZ#2455896", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455896"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32144.json"}], "timeline": [{"lang": "en", "time": "2026-04-07T13:00:56.836Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-07T12:28:00.767Z", "value": "Made public."}], "title": "Erlang OTP: Erlang OTP public_key: OCSP authorization bypass and information disclosure due to missing signature verification", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:08:34.251Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "Erlang OTP: Erlang OTP public_key: OCSP authorization bypass and information disclosure due to missing signature verification", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:openstack:16.2"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:18.0"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 18.0", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-04-07T13:00:56.836Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-07T12:28:00.767Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-04-07T12:28:00.767Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-32144", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455896", "name": "RHBZ#2455896", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32144.json", "tags": ["x_sadp-csaf-vex"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Erlang OTP public_key. This improper certificate validation vulnerability allows a remote attacker to bypass Online Certificate Status Protocol (OCSP) designated-responder authorization. The vulnerability stems from missing signature verification during OCSP response validation, enabling an attacker to forge responses that mark revoked certificates as valid. Consequently, clients may accept connections to compromised servers, potentially leading to the transmission of sensitive data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:08:34.251Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T13:15:14.355759Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T13:15:16.503Z"}}], "cna": {"title": "OCSP designated-responder authorization bypass via missing signature verification", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Igor Morgenstern / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Jakub Witczak"}, {"lang": "en", "type": "remediation reviewer", "value": "Ingela Anderton Andin"}], "impacts": [{"capecId": "CAPEC-459", "descriptions": [{"lang": "en", "value": "CAPEC-459 Creating a Rogue Certification Authority Certificate"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "modules": ["pubkey_ocsp", "ssl_stapling"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "27.3.4.10", "status": "unaffected"}, {"at": "28.4.2", "status": "unaffected"}], "version": "27.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["lib/public_key/src/pubkey_ocsp.erl", "lib/ssl/src/ssl_stapling.erl"], "defaultStatus": "unaffected", "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_ocsp"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "1.17.1.2", "status": "unaffected"}, {"at": "1.20.3", "status": "unaffected"}], "version": "1.16", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "public_key", "programFiles": ["src/pubkey_ocsp.erl"], "defaultStatus": "unaffected", "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["ssl_stapling"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "11.2.12.7", "status": "unaffected"}, {"at": "11.5.4", "status": "unaffected"}], "version": "11.2", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "ssl", "programFiles": ["src/ssl_stapling.erl"], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_ocsp", "ssl_stapling"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0", "status": "unaffected"}, {"at": "ac7ff528be857c5d35eb29c7f24106e3a16d4891", "status": "unaffected"}], "version": "601a012837ea0a5c8095bf24223132824177124d", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/public_key/src/pubkey_ocsp.erl", "lib/ssl/src/ssl_stapling.erl"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}]}], "datePublic": "2026-04-07T12:28:00.000Z", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm", "name": "OCSP designated-responder authorization bypass \u2014 missing signature verification (RFC 6960 \u00a74.2.2.2)", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-32144.html", "name": "EEF CNA record for CVE-2026-32144", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32144", "name": "OSV record EEF-CVE-2026-32144", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/601a012837ea0a5c8095bf24223132824177124d", "name": "Introducing commit 601a012 in erlang/otp", "tags": ["related"]}, {"url": "https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0", "name": "Fix commit 49033a6 in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891", "name": "Fix commit ac7ff52 in erlang/otp", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "For SSL users:\n\n* Do not enable OCSP validation setting (current default is {stapling, no_staple})\n* Use CRL-based revocation checking by setting the {crl_check, true} SSL option instead\n\nFor applications using public_key:pkix_ocsp_validate/5 directly:\n\n* Pass {is_trusted_responder_fun, Fun} option with a function that validates trusted responder certificates\n* Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)", "supportingMedia": [{"type": "text/html", "value": "<p><strong>For SSL users:</strong></p>\n<ul>\n<li>Do not enable OCSP validation setting (current default is <code>{stapling, no_staple}</code>)</li>\n<li>Use CRL-based revocation checking by setting the <code>{crl_check, true}</code> SSL option instead</li>\n</ul>\n<p><strong>For applications using <code>public_key:pkix_ocsp_validate/5</code> directly:</strong></p>\n<ul>\n<li>Pass <code>{is_trusted_responder_fun, Fun}</code> option with a function that validates trusted responder certificates</li>\n<li>Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)</li>\n</ul>", "base64": false}, {"type": "text/markdown", "value": "**For SSL users:**\n\n* Do not enable OCSP validation setting (current default is `{stapling, no_staple}`)\n* Use CRL-based revocation checking by setting the `{crl_check, true}` SSL option instead\n\n**For applications using `public_key:pkix_ocsp_validate/5` directly:**\n\n* Pass `{is_trusted_responder_fun, Fun}` option with a function that validates trusted responder certificates\n* Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.10 and OTP\u00a028.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.</p>\n<p>The OCSP response validation in <code>public_key:pkix_ocsp_validate/5</code> does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.</p>\n<p>This affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the <code>public_key:pkix_ocsp_validate/5</code> API directly are also affected, with impact depending on usage context.</p>\n<p>This vulnerability is associated with program files <code>lib/public_key/src/pubkey_ocsp.erl</code> and program routines <code>pubkey_ocsp:is_authorized_responder/3</code>.</p>\n<p>This issue affects OTP from OTP&nbsp;27.0 before OTP&nbsp;27.3.4.10 and OTP&nbsp;28.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4.</p>", "base64": false}, {"type": "text/markdown", "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in `public_key:pkix_ocsp_validate/5` does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the `public_key:pkix_ocsp_validate/5` API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files `lib/public_key/src/pubkey_ocsp.erl` and program routines `pubkey_ocsp:is_authorized_responder/3`.\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.10 and OTP\u00a028.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "configurations": [{"lang": "en", "value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., {stapling, staple}), or the application must call public_key:pkix_ocsp_validate/5 directly. OCSP stapling is disabled by default ({stapling, no_staple}).", "supportingMedia": [{"type": "text/html", "value": "<p>SSL/TLS must be configured with OCSP stapling enabled (e.g., <code>{stapling, staple}</code>), or the application must call <code>public_key:pkix_ocsp_validate/5</code> directly. OCSP stapling is disabled by default (<code>{stapling, no_staple}</code>).</p>", "base64": false}, {"type": "text/markdown", "value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., `{stapling, staple}`), or the application must call `public_key:pkix_ocsp_validate/5` directly. OCSP stapling is disabled by default (`{stapling, no_staple}`).", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:24:15.856Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32144", "state": "PUBLISHED", "dateUpdated": "2026-11-11T19:24:15.856Z", "dateReserved": "2026-03-10T22:37:29.212Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-04-07T12:28:00.767Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["pubkey_ocsp", "ssl_stapling"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/public_key/src/pubkey_ocsp.erl", "lib/ssl/src/ssl_stapling.erl"], "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.10", "status": "unaffected"}, {"at": "28.4.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "27.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["pubkey_ocsp"], "packageName": "public_key", "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/pubkey_ocsp.erl"], "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "1.17.1.2", "status": "unaffected"}, {"at": "1.20.3", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "1.16", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["ssl_stapling"], "packageName": "ssl", "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/ssl_stapling.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "11.2.12.7", "status": "unaffected"}, {"at": "11.5.4", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "11.2", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["pubkey_ocsp", "ssl_stapling"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/public_key/src/pubkey_ocsp.erl", "lib/ssl/src/ssl_stapling.erl"], "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0", "status": "unaffected"}, {"at": "ac7ff528be857c5d35eb29c7f24106e3a16d4891", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "601a012837ea0a5c8095bf24223132824177124d", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 18.0", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "2771D519-4124-4D3F-A8E0-3E4704973B3E", "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2E111DA-579A-438F-A2FF-5799B01AF401", "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/public_key:*:*:*:*:*:*:*:*", "matchCriteriaId": "459DB53B-9049-48D3-86F9-5CB3286BDCFB", "versionEndExcluding": "1.17.1.2", "versionStartIncluding": "1.16", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/public_key:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F0812B0-29FA-4EAB-B557-5FB6C8D2D581", "versionEndExcluding": "1.20.3", "versionStartIncluding": "1.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDA65CE8-5C84-4EAE-8709-44240FB9E2A1", "versionEndExcluding": "11.2.12.7", "versionStartIncluding": "11.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "C64F6749-FB4F-4757-B9B9-540612B69606", "versionEndExcluding": "11.5.4", "versionStartExcluding": "11.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP\u00a027.0 before OTP\u00a027.3.4.10 and OTP\u00a028.4.2, corresponding to public_key from 1.16 before 1.17.1.2 and 1.20.3, and ssl from 11.2 before 11.2.12.7 and 11.5.4."}, {"lang": "es", "value": "Vulnerabilidad de validaci\u00f3n de certificado incorrecta en Erlang OTP public_key (m\u00f3dulo pubkey_ocsp) permite la omisi\u00f3n de autorizaci\u00f3n de respondedor designado de OCSP a trav\u00e9s de la verificaci\u00f3n de firma faltante.\n\nLa validaci\u00f3n de respuesta OCSP en public_key:pkix_ocsp_validate/5 no verifica que un certificado de respondedor designado por CA fue firmado criptogr\u00e1ficamente por la CA emisora. En su lugar, solo verifica que el nombre del emisor del certificado del respondedor coincide con el nombre del sujeto de la CA y que el certificado tiene el uso de clave extendido OCSPSigning. Un atacante que puede interceptar o controlar respuestas OCSP puede crear un certificado autofirmado con un nombre de emisor coincidente y el EKU OCSPSigning, y usarlo para falsificar respuestas OCSP que marcan certificados revocados como v\u00e1lidos.\n\nEsto afecta a los clientes SSL/TLS que usan OCSP stapling, lo que puede aceptar conexiones a servidores con certificados revocados, potencialmente transmitiendo datos sensibles a servidores comprometidos. Las aplicaciones que usan la API public_key:pkix_ocsp_validate/5 directamente tambi\u00e9n se ven afectadas, con impacto dependiendo del contexto de uso.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/public_key/src/pubkey_ocsp.erl y las rutinas de programa pubkey_ocsp:is_authorized_responder/3.\n\nEste problema afecta a OTP desde OTP 27.0 hasta OTP 28.4.2 y 27.3.4.10 correspondiente a public_key desde 1.16 hasta 1.20.3 y 1.17.1.2, y ssl desde 11.2 hasta 11.5.4 y 11.2.12.7."}], "id": "CVE-2026-32144", "lastModified": "2026-11-11T20:17:09.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32144", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T13:15:14.355759Z", "version": "2.0.3"}}]}, "published": "2026-04-07T13:16:46.570", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-32144.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/601a012837ea0a5c8095bf24223132824177124d"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32144"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-32144"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455896"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32144.json"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-347"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "Erlang OTP: Erlang OTP public_key: OCSP authorization bypass and information disclosure due to missing signature verification", "id": "2455896", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455896"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["A flaw was found in Erlang OTP public_key. This improper certificate validation vulnerability allows a remote attacker to bypass Online Certificate Status Protocol (OCSP) designated-responder authorization. The vulnerability stems from missing signature verification during OCSP response validation, enabling an attacker to forge responses that mark revoked certificates as valid. Consequently, clients may accept connections to compromised servers, potentially leading to the transmission of sensitive data."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-32144", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-04-07T12:28:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32144\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32144\nhttps://cna.erlef.org/cves/CVE-2026-32144.html\nhttps://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0\nhttps://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891\nhttps://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm\nhttps://osv.dev/vulnerability/EEF-CVE-2026-32144\nhttps://www.erlang.org/doc/system/versions.html#order-of-versions"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.20.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "1.17.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.2.12.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "27.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "28.4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "27.3.4.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "601a012837ea0a5c8095bf24223132824177124d"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "ac7ff528be857c5d35eb29c7f24106e3a16d4891"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.20.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "1.17.1.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.2.12.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "27.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "28.4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "27.3.4.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "601a012837ea0a5c8095bf24223132824177124d"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "ac7ff528be857c5d35eb29c7f24106e3a16d4891"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "created": "2026-04-08T19:38:10.664042+00:00", "updated": "2026-08-03T08:15:03.610608+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp", "erlang$PRODUCT$otp"]}