CVE-2026-42790 Erlang OTP public_key TLS hostname verification bypass via nameConstraints

Vulnerability Overview CVE-2026-42790 Name: nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification Description: The module in Erlang OTP (including and ) contains an incorrect certificate verification vulnerability. This vulnerability allows bypassing in TLS hostname verification via a fallback mechanism. The combination of two flaws allows a subordinate CA (whose DNS are restricted, e.g., ) to issue a leaf certificate that an OTP TLS client accepts as valid for an out-of-scope hostname (e.g., ). 1. : Only checks against SAN entries. According to RFC 5280, permitted DNS subtrees only constrain certificates containing DNS type names. Leaf certificates lacking a are therefore only required to satisfy any constraints, regardless of their . 2. : Falls back to when no is present. It extracts the attribute as the presented ID and matches it against the reference hostname. The strict matcher does not suppress this fallback. As a result, path validation accepts CN-only leaf certificates even when an intermediate certificate has DNS constraints (absence of SAN means are not triggered), and hostname verification accepts it via the CN fallback. This bypass is reachable from with , trusted CAs, SNI, and the canonical hostname matcher. CVSS 4.0 Score: 7.6 (HIGH) CWE: CWE-295 — Improper Certificate Validation CAPEC: CAPEC-475 — Signature Spoofing by Improper Validation Affected Range This vulnerability affects OTP from OTP 19.3 to OTP 26.2.5.21, 27.3.12, 28.5.01, and 29.0.1, corresponding to from 1.4 to 1.15.17, 1.17.13, 1.20.3.1, and 1.21.1. Affected Modules: Affected Versions: : 1.4 : 19.3 : b8c345e813 Remediation Workarounds: The option in the application can be used to ensure that TLS connections fail if the end-entity certificate lacks a extension or has no domain names. Do not use that accepts errors. Fixed Versions: : 26.2.5.21 : 27.3.4.12 : 28.5.0.1 : 29.0.1 : 07e9058c09 : f567c6d183 : 21abe0644b References: GitHub Advisory OSV Vulnerability GitHub Commit 1 GitHub Commit 2 GitHub Commit 3 Credits: Finder: John Downey Remediation developer: Ingela Anderton Andin Remediation reviewer: Dan Gudmundsson Remediation reviewer**: Jakub Witzcak

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-42790 Erlang OTP public_key TLS hostname verification bypass via nameConstraints