CVE-2026-32144
Full vulnerability record from the local CVENow database.
Description
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid. This affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context. This vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3. This issue affects OTP from OTP 27.0 before OTP 28.4.2 and OTP 27.3.4.10, corresponding to public_key from 1.16 before 1.20.3 and 1.17.1.2, and ssl from 11.2 before 11.5.4 and 11.2.12.7.
Severity
HIGH
CVSS score
7.6
(v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-04-07 13:16:46.570000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-32144",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-04-07T13:16:46.570",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP 27.0 before OTP 28.4.2 and OTP 27.3.4.10, corresponding to public_key from 1.16 before 1.20.3 and 1.17.1.2, and ssl from 11.2 before 11.5.4 and 11.2.12.7."
},
{
"lang": "es",
"value": "Vulnerabilidad de validación de certificado incorrecta en Erlang OTP public_key (módulo pubkey_ocsp) permite la omisión de autorización de respondedor designado de OCSP a través de la verificación de firma faltante.\n\nLa validación de respuesta OCSP en public_key:pkix_ocsp_validate/5 no verifica que un certificado de respondedor designado por CA fue firmado criptográficamente por la CA emisora. En su lugar, solo verifica que el nombre del emisor del certificado del respondedor coincide con el nombre del sujeto de la CA y que el certificado tiene el uso de clave extendido OCSPSigning. Un atacante que puede interceptar o controlar respuestas OCSP puede crear un certificado autofirmado con un nombre de emisor coincidente y el EKU OCSPSigning, y usarlo para falsificar respuestas OCSP que marcan certificados revocados como válidos.\n\nEsto afecta a los clientes SSL/TLS que usan OCSP stapling, lo que puede aceptar conexiones a servidores con certificados revocados, potencialmente transmitiendo datos sensibles a servidores comprometidos. Las aplicaciones que usan la API public_key:pkix_ocsp_validate/5 directamente también se ven afectadas, con impacto dependiendo del contexto de uso.\n\nEsta vulnerabilidad está asociada con los archivos de programa lib/public_key/src/pubkey_ocsp.erl y las rutinas de programa pubkey_ocsp:is_authorized_responder/3.\n\nEste problema afecta a OTP desde OTP 27.0 hasta OTP 28.4.2 y 27.3.4.10 correspondiente a public_key desde 1.16 hasta 1.20.3 y 1.17.1.2, y ssl desde 11.2 hasta 11.5.4 y 11.2.12.7."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unknown",
"packageName": "public_key",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"pubkey_ocsp"
],
"programFiles": [
"src/pubkey_ocsp.erl"
],
"programRoutines": [
{
"name": "pubkey_ocsp:is_authorized_responder/3"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"versions": [
{
"version": "1.16",
"lessThan": "*",
"versionType": "otp",
"status": "affected",
"changes": [
{
"at": "1.20.3",
"status": "unaffected"
},
{
"at": "1.17.1.2",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unknown",
"packageName": "ssl",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"ssl_stapling"
],
"programFiles": [
"src/ssl_stapling.erl"
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"versions": [
{
"version": "11.2",
"lessThan": "*",
"versionType": "otp",
"status": "affected",
"changes": [
{
"at": "11.5.4",
"status": "unaffected"
},
{
"at": "11.2.12.7",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unknown",
"collectionURL": "https://github.com",
"packageName": "erlang/otp",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"pubkey_ocsp"
],
"programFiles": [
"lib/public_key/src/pubkey_ocsp.erl"
],
"programRoutines": [
{
"name": "pubkey_ocsp:is_authorized_responder/3"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"versions": [
{
"version": "27.0",
"lessThan": "*",
"versionType": "otp",
"status": "affected",
"changes": [
{
"at": "28.4.2",
"status": "unaffected"
},
{
"at": "27.3.4.10",
"status": "unaffected"
}
]
},
{
"version": "601a012837ea0a5c8095bf24223132824177124d",
"lessThan": "*",
"versionType": "git",
"status": "affected",
"changes": [
{
"at": "ac7ff528be857c5d35eb29c7f24106e3a16d4891",
"status": "unaffected"
},
{
"at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0",
"status": "unaffected"
}
]
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 16.2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "erlang",
"cpes": [
"cpe:/a:redhat:openstack:16.2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 17.1",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "erlang",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 18.0",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "erlang",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-07T13:15:14.355759Z",
"id": "CVE-2026-32144",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "27.0",
"versionEndExcluding": "27.3.4.10",
"matchCriteriaId": "2771D519-4124-4D3F-A8E0-3E4704973B3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "28.0",
"versionEndExcluding": "28.4.2",
"matchCriteriaId": "D2E111DA-579A-438F-A2FF-5799B01AF401"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/public_key:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.16",
"versionEndExcluding": "1.17.1.2",
"matchCriteriaId": "459DB53B-9049-48D3-86F9-5CB3286BDCFB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/public_key:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.18",
"versionEndExcluding": "1.20.3",
"matchCriteriaId": "2F0812B0-29FA-4EAB-B557-5FB6C8D2D581"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.2",
"versionEndExcluding": "11.2.12.7",
"matchCriteriaId": "BDA65CE8-5C84-4EAE-8709-44240FB9E2A1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*",
"versionStartExcluding": "11.3",
"versionEndExcluding": "11.5.4",
"matchCriteriaId": "C64F6749-FB4F-4757-B9B9-540612B69606"
}
]
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-32144.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Mitigation",
"Third Party Advisory"
]
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32144",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-32144",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455896",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32144.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}