← Back to CVE Explorer

CVE-2026-42790

Full vulnerability record from the local CVENow database.

Description

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com): First, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no subjectAltName therefore trivially satisfies any permitted;DNS:... constraint regardless of its subject commonName. Second, public_key:pkix_verify_hostname/3 in lib/public_key/src/public_key.erl falls back to the subject commonName when no subjectAltName is present, extracting id-at-commonName attributes as presented IDs and matching them against the reference hostname. The strict pkix_verify_hostname_match_fun(https) matcher does not suppress this fallback. The result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the nameConstraints are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock ssl:connect with verify_peer, a trusted CA, SNI, and the canonical strict https hostname matcher. This issue affects OTP from OTP 19.3 before OTP 29.0.1, OTP 28.5.0.1, OTP 27.3.4.12 and OTP 26.2.5.21, corresponding to public_key from 1.4 before 1.21.1, 1.20.3.1, 1.17.1.3 and 1.15.1.7.

Severity
HIGH
CVSS score
7.6 (v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-05-27 17:16:36.030000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON 
{
  "id": "CVE-2026-42790",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-05-27T17:16:36.030",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification.\n\nTwo flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com):\n\nFirst, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no subjectAltName therefore trivially satisfies any permitted;DNS:... constraint regardless of its subject commonName.\n\nSecond, public_key:pkix_verify_hostname/3 in lib/public_key/src/public_key.erl falls back to the subject commonName when no subjectAltName is present, extracting id-at-commonName attributes as presented IDs and matching them against the reference hostname. The strict pkix_verify_hostname_match_fun(https) matcher does not suppress this fallback.\n\nThe result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the nameConstraints are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock ssl:connect with verify_peer, a trusted CA, SNI, and the canonical strict https hostname matcher.\n\nThis issue affects OTP from OTP 19.3 before OTP 29.0.1, OTP 28.5.0.1, OTP 27.3.4.12 and OTP 26.2.5.21, corresponding to public_key from 1.4 before 1.21.1, 1.20.3.1, 1.17.1.3 and 1.15.1.7."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de validación de certificado incorrecta en Erlang OTP public_key (módulos pubkey_cert y public_key) permite una omisión de nameConstraints de DNS a través de la reserva de CommonName del sujeto en la verificación de nombre de host TLS.\n\nDos fallos se combinan para permitir que una CA subordinada cuyas nameConstraints de DNS están restringidas (p. ej., permitted;DNS:allowed.example.com) emita un certificado hoja que un cliente TLS de OTP acepta como una identidad válida para un nombre de host fuera de alcance (p. ej., victim.example.com):\n\nPrimero, pubkey_cert:validate_names/6 en lib/public_key/src/pubkey_cert.erl solo verifica las entradas DNS de SAN contra las nameConstraints. Según RFC 5280, un subárbol DNS permitido solo restringe los certificados que contienen un nombre de tipo DNS. Una hoja sin subjectAltName, por lo tanto, satisface trivialmente cualquier restricción permitted;DNS:... independientemente de su commonName de sujeto.\n\nSegundo, public_key:pkix_verify_hostname/3 en lib/public_key/src/public_key.erl recurre al commonName del sujeto cuando no hay subjectAltName presente, extrayendo atributos id-at-commonName como IDs presentados y comparándolos con el nombre de host de referencia. El comparador estricto pkix_verify_hostname_match_fun(HTTPS) no suprime esta reserva.\n\nEl resultado es que la validación de ruta acepta una hoja solo con CN bajo un intermedio restringido por DNS (sin SAN significa que las nameConstraints no se activan), y la verificación de nombre de host luego lo acepta a través de la reserva de CN. La omisión es alcanzable desde ssl:connect estándar con verify_peer, una CA de confianza, SNI y el comparador canónico estricto de nombre de host HTTPS.\n\nEste problema afecta a OTP desde OTP 19.3 antes de OTP 26.2.5.21, 27.3.4.12, 28.5.0.1 y 29.0.1 correspondiente a public_key desde 1.4 antes de 1.15.1.7, 1.17.1.3, 1.20.3.1 y 1.21.1."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unknown",
          "packageName": "public_key",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "pubkey_cert",
            "public_key"
          ],
          "programFiles": [
            "src/pubkey_cert.erl",
            "src/public_key.erl"
          ],
          "programRoutines": [
            {
              "name": "pubkey_cert:validate_names/6"
            },
            {
              "name": "public_key:pkix_verify_hostname/3"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "versions": [
            {
              "version": "1.4",
              "lessThan": "*",
              "versionType": "otp",
              "status": "affected",
              "changes": [
                {
                  "at": "1.15.1.7",
                  "status": "unaffected"
                },
                {
                  "at": "1.17.1.3",
                  "status": "unaffected"
                },
                {
                  "at": "1.20.3.1",
                  "status": "unaffected"
                },
                {
                  "at": "1.21.1",
                  "status": "unaffected"
                }
              ]
            }
          ]
        },
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unknown",
          "collectionURL": "https://github.com",
          "packageName": "erlang/otp",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "pubkey_cert",
            "public_key"
          ],
          "programFiles": [
            "lib/public_key/src/pubkey_cert.erl",
            "lib/public_key/src/public_key.erl"
          ],
          "programRoutines": [
            {
              "name": "pubkey_cert:validate_names/6"
            },
            {
              "name": "public_key:pkix_verify_hostname/3"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "versions": [
            {
              "version": "19.3",
              "lessThan": "*",
              "versionType": "otp",
              "status": "affected",
              "changes": [
                {
                  "at": "26.2.5.21",
                  "status": "unaffected"
                },
                {
                  "at": "27.3.4.12",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.1",
                  "status": "unaffected"
                },
                {
                  "at": "29.0.1",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "b0c245e8132bb13171e277b1af59c0cec00c9459",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected",
              "changes": [
                {
                  "at": "0769050c69d73762672b0db1347b6993a5b31759",
                  "status": "unaffected"
                },
                {
                  "at": "fb67c6d1836f51105a96d8b769e71e4215a79457",
                  "status": "unaffected"
                },
                {
                  "at": "21abed64eb2026b5f82f432709e4e932f9be389a",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenStack Platform 16.2",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "erlang",
          "cpes": [
            "cpe:/a:redhat:openstack:16.2::el8"
          ],
          "versions": [
            {
              "version": "0:23.3.4.18-2.el8ost",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenStack Services on OpenShift 18.0",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "erlang",
          "cpes": [
            "cpe:/a:redhat:openstack:18.0::el9"
          ],
          "versions": [
            {
              "version": "0:26.2.5.21-2.el9ost",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Hardened Images",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "erlang27",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenStack Platform 17.1",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "erlang",
          "cpes": [
            "cpe:/a:redhat:openstack:17.1"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      },
      {
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-27T00:00:00+00:00",
          "id": "CVE-2026-42790",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        },
        {
          "lang": "en",
          "value": "CWE-297"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "19.3",
              "versionEndExcluding": "26.2.5.21",
              "matchCriteriaId": "245CC08C-EB1F-4230-8F4B-98CFFB623EB2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "27.0",
              "versionEndExcluding": "27.3.4.12",
              "matchCriteriaId": "91269F6D-B8A3-41F2-871C-79EBB9460BE8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "28.0",
              "versionEndExcluding": "28.5.0.1",
              "matchCriteriaId": "844A3F01-AF3C-4C48-81DB-932B803D22C4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "29.0",
              "versionEndExcluding": "29.0.1",
              "matchCriteriaId": "46976598-817C-4E93-AC4B-46434746C25F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-42790.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/erlang/otp/commit/0769050c69d73762672b0db1347b6993a5b31759",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/erlang/otp/commit/21abed64eb2026b5f82f432709e4e932f9be389a",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/erlang/otp/commit/fb67c6d1836f51105a96d8b769e71e4215a79457",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-42790",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:39809",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:54757",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-42790",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482286",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42790.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ]
}