Erlang OTP public_key Certificate Chain Validation Bypass CVE-2026-42789

Vulnerability Overview CVE ID: CVE-2026-42789 Vulnerability Name: Non-CA certificate accepted as intermediate issuer in public_key path validation Vulnerability Description: The module (specifically the module) in Erlang OTP contains a vulnerability that allows non-CA certificates to be accepted as intermediate issuers, thereby enabling certificate chain forgery. Specifically, the function in has two flaws that allow a certificate with and no extension to be used as an intermediate issuer in a chain passed to . When the certificate is in the issuer position, the clause recurses through the remaining extensions without rejecting the certificate, and the check only takes effect if the extension is present; therefore, certificates missing completely bypass the enforcement. Impact Scope Affected Module: Affected Versions: - OTP versions prior to 0.22 (1.15.17, 1.17.13, 1.20.3.1, 1.21.1) - OTP 26.2.5.21, 27.3.4.12, 28.5.0.1, 29.0.1 Affected Applications: Any TLS or mTLS endpoints relying on the default validator, including server authentication and client certificate verification. Remediation Fixed Versions: - OTP 1.15.17, 1.17.13, 1.20.3.1, 1.21.1 - OTP 26.2.5.21, 27.3.4.12, 28.5.0.1, 29.0.1 Temporary Workaround: Use the option in the or applications to ensure path validation rejects intermediate certificates that do not have . References GitHub Advisory OSV.dev Vulnerability GitHub Commit GitHub Commit Contributors Finder: John Downey Remediation Developer: Ingela Andin Analyst: Jakub Witczak CVSS Score CVSS 4.0 Score: 7 (HIGH) Additional Information Foundation Website: Foundation Website « Back to all CVEs: « Back to all CVEs See on OSV.dev: See on OSV.dev »

Goal Reached Thanks to every supporter — we hit 100%!

Erlang OTP public_key Certificate Chain Validation Bypass CVE-2026-42789