CVE-2026-42790
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and…
Technology
Erlang/OTP
CVSS Score
8.1 / 10.0
Affected Versions
>=19.3 <26.2.5.21; >=27.0 <27.3.4.12; >=28.0 <28.5.0.1; >=29.0 <29.0.1
Upstream Fix
See upstream advisory
Published
May 27, 2026
OSSeva Coverage
Fixed upstream
Description
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com): First, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts cer
Is your Erlang/OTP deployment affected?
If you're running >=19.3 <26.2.5.21; >=27.0 <27.3.4.12; >=28.0 <28.5.0.1; >=29.0 <29.0.1, you need this patch. Book a discovery call to get covered.
View Erlang/OTP coverage →Get a quote
Running Erlang/OTP >=19.3 <26.2.5.21; >=27.0 <27.3.4.12; >=28.0 <28.5.0.1; >=29.0 <29.0.1?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?