Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-42789— Non-CA certificate accepted as intermediate issuer in public_key path validation

Quick assessment

Affected
Erlang OTP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP存在安全漏洞，该漏洞源于public_key模块中证书链信任遵循不当，允许非CA证书被接受为中间颁发者，可能导致证书链伪造。以下版本受到影响：17.0至26.2.5.21之前版本、27.3.4.12之前版本、28.5.0.1之前版本和29.0.1之前版本。

CVSS 7.0 · High EPSS 0.33% · P25

Affected Version Matrix 3

VendorProduct Version RangeStatus
Erlang OTP 0.22< * affected
17.0< * affected
84adefa331c4159d432d22840663c38f155cd4c1< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-42789

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Non-CA certificate accepted as intermediate issuer in public_key path validation
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement. Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers. This issue affects OTP from OTP 17.0 before OTP 29.0.1, OTP 28.5.0.1, OTP 27.3.4.12 and OTP 26.2.5.21, corresponding to public_key from 0.22 before 1.21.1, 1.20.3.1, 1.17.1.3 and 1.15.1.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Erlang/OTP 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Erlang/OTP是Erlang/OTP开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP存在安全漏洞，该漏洞源于public_key模块中证书链信任遵循不当，允许非CA证书被接受为中间颁发者，可能导致证书链伪造。以下版本受到影响：17.0至26.2.5.21之前版本、27.3.4.12之前版本、28.5.0.1之前版本和29.0.1之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Erlang OTP 0.22 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 17.0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-42789

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-42789

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-42789 (2)

Vendor Advisories for CVE-2026-42789 (3)

Same Patch Batch · Erlang · 2026-05-27 · 3 CVEs total

CVE-2026-42790 7.6 HIGH nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verifica
CVE-2026-42791 6.3 MEDIUM OCSP responder certificate validity period not checked in public_key

IV. Related Vulnerabilities

Same product: OTP
Same vendor: Erlang
Same weakness: CWE-295

V. Comments for CVE-2026-42789

No comments yet

Leave a comment