CVE-2026-42789

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42789", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-04-29T18:06:33.251Z", "datePublished": "2026-05-27T12:23:06.355Z", "dateUpdated": "2026-10-14T16:55:37.359Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["pubkey_cert"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/public_key/src/pubkey_cert.erl"], "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.19", "status": "unaffected"}, {"at": "28.5.0.8", "status": "unaffected"}, {"at": "29.1.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["pubkey_cert"], "packageName": "public_key", "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/pubkey_cert.erl"], "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "1.17.1.7", "status": "unaffected"}, {"at": "1.20.3.6", "status": "unaffected"}, {"at": "1.21.8", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "0.22", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["pubkey_cert"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/public_key/src/pubkey_cert.erl"], "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "status": "unaffected"}, {"at": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "status": "unaffected"}, {"at": "82af606b5437c4de1276dbcc8855a47e88231226", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "82af606b5437c4de1276dbcc8855a47e88231226", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.19", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.5.0.8", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "29.1.2", "versionStartIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "John Downey"}, {"lang": "en", "type": "remediation developer", "value": "Ingela Anderton Andin"}, {"lang": "en", "type": "analyst", "value": "Jakub Witczak"}, {"lang": "en", "type": "remediation reviewer", "value": "Ada Logics"}], "datePublic": "2026-05-27T12:23:06.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP <code>public_key</code> (<code>pubkey_cert</code> module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.</p>\n<p>In <code>lib/public_key/src/pubkey_cert.erl</code>, <code>pubkey_cert:validate_extensions/7</code> contains two flaws that together allow a certificate with <code>basicConstraints cA:false</code> and no <code>keyUsage</code> extension to be used as an intermediate issuer in a chain passed to <code>public_key:pkix_path_validation/3</code>: the <code>cA:false</code> clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the <code>keyUsage</code> check only fires when the extension is present, so a certificate lacking <code>keyUsage</code> entirely bypasses the <code>keyCertSign</code> enforcement.</p>\n<p>Any party holding an end-entity certificate with <code>basicConstraints cA:false</code> and no <code>keyUsage</code> extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. <code>public_key:pkix_path_validation/3</code> accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP <code>ssl</code> application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;27.3.4.19, OTP&nbsp;28.5.0.8, and OTP&nbsp;29.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP&nbsp;17.0, corresponding to public_key before 0.22, is affected is unknown.</p>"}, {"base64": false, "type": "text/markdown", "value": "Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP `public_key` (`pubkey_cert` module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.\n\nIn `lib/public_key/src/pubkey_cert.erl`, `pubkey_cert:validate_extensions/7` contains two flaws that together allow a certificate with `basicConstraints cA:false` and no `keyUsage` extension to be used as an intermediate issuer in a chain passed to `public_key:pkix_path_validation/3`: the `cA:false` clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the `keyUsage` check only fires when the extension is present, so a certificate lacking `keyUsage` entirely bypasses the `keyCertSign` enforcement.\n\nAny party holding an end-entity certificate with `basicConstraints cA:false` and no `keyUsage` extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. `public_key:pkix_path_validation/3` accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP `ssl` application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP\u00a017.0, corresponding to public_key before 0.22, is affected is unknown."}], "value": "Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.\n\nIn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.\n\nAny party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP\u00a017.0, corresponding to public_key before 0.22, is affected is unknown."}], "impacts": [{"capecId": "CAPEC-475", "descriptions": [{"lang": "en", "value": "CAPEC-475 Signature Spoofing by Improper Validation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-296", "description": "CWE-296 Improper Following of a Certificate's Chain of Trust", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-14T16:55:37.359Z"}, "references": [{"name": "GitHub Advisory", "tags": ["related", "vendor-advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq"}, {"name": "EEF CNA record for CVE-2026-42789", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-42789.html"}, {"name": "OSV record EEF-CVE-2026-42789", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-42789"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Fix commit 0a05b7c in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8"}, {"name": "Fix commit 75ca4c0 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333"}, {"name": "Fix commit 82af606 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/82af606b5437c4de1276dbcc8855a47e88231226"}], "source": {"discovery": "EXTERNAL"}, "title": "Non-CA certificate accepted as intermediate issuer in public_key path validation", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The <code>verify_fun</code> option in the <code>ssl</code> or <code>public_key</code> application can be used to ensure that path validation rejects chains where an intermediate certificate does not have <code>basicConstraints cA:true</code>.</p>"}, {"base64": false, "type": "text/markdown", "value": "The `verify_fun` option in the `ssl` or `public_key` application can be used to ensure that path validation rejects chains where an intermediate certificate does not have `basicConstraints cA:true`."}], "value": "The verify_fun option in the ssl or public_key application can be used to ensure that path validation rejects chains where an intermediate certificate does not have basicConstraints cA:true."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T15:41:47.903975Z", "id": "CVE-2026-42789", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T15:43:46.333Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2::el8"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:23.3.4.18-2.el8ost", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0::el9"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Services on OpenShift 18.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:26.2.5.21-2.el9ost", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "erlang27", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}], "datePublic": "2026-05-27T12:23:06.355Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Erlang OTP's public_key module. This vulnerability (CWE-295), related to improper certificate validation, allows a non-Certificate Authority (CA) certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can exploit this by forging leaf certificates for arbitrary identities. This can lead to compromised server identity verification on the client side and client certificate verification on mutual Transport Layer Security (mTLS) servers, undermining the trust in certificate-based authentication."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-42789"}, {"name": "RHBZ#2482093", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482093"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42789.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:54757"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:39809"}], "solutions": [{"lang": "en", "value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2"}, {"lang": "en", "value": "RHSA-2026:39809: Red Hat OpenStack Services on OpenShift 18.0"}], "timeline": [{"lang": "en", "time": "2026-05-27T15:10:36.175Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-27T12:23:06.355Z", "value": "Made public."}], "title": "erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-18T12:04:44.359Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:openstack:16.2::el8"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "versions": [{"status": "unaffected", "version": "0:23.3.4.18-2.el8ost", "lessThan": "*", "versionType": "rpm"}], "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:18.0::el9"], "vendor": "Red Hat", "product": "Red Hat OpenStack Services on OpenShift 18.0", "versions": [{"status": "unaffected", "version": "0:26.2.5.21-2.el9ost", "lessThan": "*", "versionType": "rpm"}], "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "erlang27", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-27T15:10:36.175Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-27T12:23:06.355Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2"}, {"lang": "en", "value": "RHSA-2026:39809: Red Hat OpenStack Services on OpenShift 18.0"}], "x_adpType": "supplier", "datePublic": "2026-05-27T12:23:06.355Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-42789", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482093", "name": "RHBZ#2482093", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42789.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54757", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:39809", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Erlang OTP's public_key module. This vulnerability (CWE-295), related to improper certificate validation, allows a non-Certificate Authority (CA) certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can exploit this by forging leaf certificates for arbitrary identities. This can lead to compromised server identity verification on the client side and client certificate verification on mutual Transport Layer Security (mTLS) servers, undermining the trust in certificate-based authentication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-18T12:04:44.359Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42789", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T15:41:47.903975Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T15:43:29.627Z"}}], "cna": {"title": "Non-CA certificate accepted as intermediate issuer in public_key path validation", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "John Downey"}, {"lang": "en", "type": "remediation developer", "value": "Ingela Anderton Andin"}, {"lang": "en", "type": "analyst", "value": "Jakub Witczak"}, {"lang": "en", "type": "remediation reviewer", "value": "Ada Logics"}], "impacts": [{"capecId": "CAPEC-475", "descriptions": [{"lang": "en", "value": "CAPEC-475 Signature Spoofing by Improper Validation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "modules": ["pubkey_cert"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "27.3.4.19", "status": "unaffected"}, {"at": "28.5.0.8", "status": "unaffected"}, {"at": "29.1.2", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["lib/public_key/src/pubkey_cert.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_cert"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "1.17.1.7", "status": "unaffected"}, {"at": "1.20.3.6", "status": "unaffected"}, {"at": "1.21.8", "status": "unaffected"}], "version": "0.22", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "public_key", "programFiles": ["src/pubkey_cert.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_cert"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "status": "unaffected"}, {"at": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "status": "unaffected"}, {"at": "82af606b5437c4de1276dbcc8855a47e88231226", "status": "unaffected"}], "version": "84adefa331c4159d432d22840663c38f155cd4c1", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "82af606b5437c4de1276dbcc8855a47e88231226", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/public_key/src/pubkey_cert.erl"], "collectionURL": "https://github.com", "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}]}], "datePublic": "2026-05-27T12:23:06.000Z", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq", "name": "GitHub Advisory", "tags": ["related", "vendor-advisory"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-42789.html", "name": "EEF CNA record for CVE-2026-42789", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-42789", "name": "OSV record EEF-CVE-2026-42789", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "name": "Fix commit 0a05b7c in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "name": "Fix commit 75ca4c0 in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/82af606b5437c4de1276dbcc8855a47e88231226", "name": "Fix commit 82af606 in erlang/otp", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "The verify_fun option in the ssl or public_key application can be used to ensure that path validation rejects chains where an intermediate certificate does not have basicConstraints cA:true.", "supportingMedia": [{"type": "text/html", "value": "<p>The <code>verify_fun</code> option in the <code>ssl</code> or <code>public_key</code> application can be used to ensure that path validation rejects chains where an intermediate certificate does not have <code>basicConstraints cA:true</code>.</p>", "base64": false}, {"type": "text/markdown", "value": "The `verify_fun` option in the `ssl` or `public_key` application can be used to ensure that path validation rejects chains where an intermediate certificate does not have `basicConstraints cA:true`.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.\n\nIn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.\n\nAny party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP\u00a017.0, corresponding to public_key before 0.22, is affected is unknown.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP <code>public_key</code> (<code>pubkey_cert</code> module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.</p>\n<p>In <code>lib/public_key/src/pubkey_cert.erl</code>, <code>pubkey_cert:validate_extensions/7</code> contains two flaws that together allow a certificate with <code>basicConstraints cA:false</code> and no <code>keyUsage</code> extension to be used as an intermediate issuer in a chain passed to <code>public_key:pkix_path_validation/3</code>: the <code>cA:false</code> clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the <code>keyUsage</code> check only fires when the extension is present, so a certificate lacking <code>keyUsage</code> entirely bypasses the <code>keyCertSign</code> enforcement.</p>\n<p>Any party holding an end-entity certificate with <code>basicConstraints cA:false</code> and no <code>keyUsage</code> extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. <code>public_key:pkix_path_validation/3</code> accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP <code>ssl</code> application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;27.3.4.19, OTP&nbsp;28.5.0.8, and OTP&nbsp;29.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP&nbsp;17.0, corresponding to public_key before 0.22, is affected is unknown.</p>", "base64": false}, {"type": "text/markdown", "value": "Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP `public_key` (`pubkey_cert` module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.\n\nIn `lib/public_key/src/pubkey_cert.erl`, `pubkey_cert:validate_extensions/7` contains two flaws that together allow a certificate with `basicConstraints cA:false` and no `keyUsage` extension to be used as an intermediate issuer in a chain passed to `public_key:pkix_path_validation/3`: the `cA:false` clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the `keyUsage` check only fires when the extension is present, so a certificate lacking `keyUsage` entirely bypasses the `keyCertSign` enforcement.\n\nAny party holding an end-entity certificate with `basicConstraints cA:false` and no `keyUsage` extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. `public_key:pkix_path_validation/3` accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP `ssl` application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP\u00a017.0, corresponding to public_key before 0.22, is affected is unknown.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-296", "description": "CWE-296 Improper Following of a Certificate's Chain of Trust"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.19"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.5.0.8", "versionStartIncluding": "28.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "29.1.2", "versionStartIncluding": "29.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-14T16:55:37.359Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42789", "state": "PUBLISHED", "dateUpdated": "2026-10-14T16:55:37.359Z", "dateReserved": "2026-04-29T18:06:33.251Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-05-27T12:23:06.355Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["pubkey_cert"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/public_key/src/pubkey_cert.erl"], "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.19", "status": "unaffected"}, {"at": "28.5.0.8", "status": "unaffected"}, {"at": "29.1.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["pubkey_cert"], "packageName": "public_key", "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/pubkey_cert.erl"], "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "1.17.1.7", "status": "unaffected"}, {"at": "1.20.3.6", "status": "unaffected"}, {"at": "1.21.8", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "0.22", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["pubkey_cert"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/public_key/src/pubkey_cert.erl"], "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "status": "unaffected"}, {"at": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "status": "unaffected"}, {"at": "82af606b5437c4de1276dbcc8855a47e88231226", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "82af606b5437c4de1276dbcc8855a47e88231226", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:16.2::el8"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 16.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:23.3.4.18-2.el8ost", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:18.0::el9"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Services on OpenShift 18.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:26.2.5.21-2.el9ost", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "erlang27", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openstack:17.1"], "defaultStatus": "affected", "packageName": "erlang", "product": "Red Hat OpenStack Platform 17.1", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "F25CA266-A367-4D08-8717-0D1A6694DBDC", "versionEndExcluding": "26.2.5.21", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "91269F6D-B8A3-41F2-871C-79EBB9460BE8", "versionEndExcluding": "27.3.4.12", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "844A3F01-AF3C-4C48-81DB-932B803D22C4", "versionEndExcluding": "28.5.0.1", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "46976598-817C-4E93-AC4B-46434746C25F", "versionEndExcluding": "29.0.1", "versionStartIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.\n\nIn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.\n\nAny party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP\u00a017.0, corresponding to public_key before 0.22, is affected is unknown."}, {"lang": "es", "value": "Vulnerabilidad de seguimiento incorrecto de la cadena de confianza de un certificado en Erlang OTP public_key (m\u00f3dulo pubkey_cert) permite que un certificado que no es de CA sea aceptado como emisor intermedio, lo que posibilita la falsificaci\u00f3n de la cadena de certificados.\n\nEn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contiene dos fallos que juntos permiten que un certificado con basicConstraints cA:false y sin extensi\u00f3n keyUsage sea utilizado como emisor intermedio en una cadena pasada a public_key:pkix_path_validation/3: la cl\u00e1usula cA:false recurre en las extensiones restantes sin rechazar el certificado cuando est\u00e1 en posici\u00f3n de emisor, y la verificaci\u00f3n de keyUsage solo se activa cuando la extensi\u00f3n est\u00e1 presente, por lo que un certificado que carece de keyUsage elude completamente la aplicaci\u00f3n de keyCertSign.\n\nCualquier parte que posea un certificado de entidad final con basicConstraints cA:false y sin extensi\u00f3n keyUsage, emitido por cualquier CA en el almac\u00e9n de confianza de la v\u00edctima, puede usar la clave privada de ese certificado para firmar certificados hoja falsificados para identidades arbitrarias. public_key:pkix_path_validation/3 acepta la cadena resultante, y por extensi\u00f3n, cada endpoint TLS o mTLS construido sobre la aplicaci\u00f3n OTP ssl que depende del verificador predeterminado se ve afectado, incluyendo la verificaci\u00f3n de identidad del servidor en el lado del cliente y la verificaci\u00f3n de certificados del cliente en servidores mTLS.\n\nEste problema afecta a OTP desde la versi\u00f3n OTP 17.0 hasta versiones anteriores a la OTP 27.3.4.19, as\u00ed como a las versiones OTP 28.5.0.8 y OTP 29.1.2, lo que corresponde a public_key desde la versi\u00f3n 0.22 hasta versiones anteriores a la 1.17.1.7, as\u00ed como a las versiones 1.20.3.6 y 1.21.8. Se desconoce si OTP en versiones anteriores a la OTP 17.0, lo que corresponde a public_key en versiones anteriores a la 0.22, se ve afectado."}], "id": "CVE-2026-42789", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.8, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42789", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T15:41:47.903975Z", "version": "2.0.3"}}]}, "published": "2026-05-27T14:16:53.267", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-42789.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/82af606b5437c4de1276dbcc8855a47e88231226"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-42789"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Product"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:39809"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:54757"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-42789"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482093"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42789.json"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-296"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-295"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation", "id": "2482093", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482093"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["A flaw was found in Erlang OTP's public_key module. This vulnerability (CWE-295), related to improper certificate validation, allows a non-Certificate Authority (CA) certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can exploit this by forging leaf certificates for arbitrary identities. This can lead to compromised server identity verification on the client side and client certificate verification on mutual Transport Layer Security (mTLS) servers, undermining the trust in certificate-based authentication."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-42789", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-05-27T12:23:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-42789\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42789\nhttps://cna.erlef.org/cves/CVE-2026-42789.html\nhttps://github.com/erlang/otp/commit/471cd2f664300a95353c467873800bbe706005db\nhttps://github.com/erlang/otp/commit/59c8d824386b2eb1614ff9340624843ef6aca0fd\nhttps://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq\nhttps://osv.dev/vulnerability/EEF-CVE-2026-42789\nhttps://www.erlang.org/doc/system/versions.html#order-of-versions"], "statement": "This is an Important vulnerability where Erlang OTP's `public_key` module improperly validates certificate chains. A remote attacker with an existing end-entity certificate from a trusted Certificate Authority can forge new leaf certificates, leading to compromised server or client identity verification in TLS/mTLS connections. This impacts applications within Red Hat OpenStack Platform and Community Projects that utilize the default verifier in the OTP `ssl` application. Because an attacker must be able to create or locate a certificate with specific attributes, Red Hat assesses the impact of this vulnerability as Important.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.22,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.22,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "84adefa331c4159d432d22840663c38f155cd4c1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "created": "2026-05-27T16:30:36.644700+00:00", "updated": "2026-10-17T10:45:07.868563+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp", "erlang$PRODUCT$otp"]}