CVE-2026-42791
Full vulnerability record from the local CVENow database.
Description
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid. This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate. This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-05-27 14:16:53.460000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-42791",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-05-27T14:16:53.460",
"lastModified": "2026-10-26T11:10:00.157",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.\n\nOCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.\n\nThis affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.\n\nThis issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3."
},
{
"lang": "es",
"value": "Vulnerabilidad de validación de certificado incorrecta en Erlang OTP public_key (módulo pubkey_ocsp) permite que respuestas OCSP falsificadas firmadas con un certificado de respondedor caducado sean aceptadas como válidas.\n\nLa verificación de respuesta OCSP en pubkey_ocsp:verify_response/5 y pubkey_ocsp:is_authorized_responder/3 en lib/public_key/src/pubkey_ocsp.erl no verifica el período de validez (notBefore/notAfter) del certificado del respondedor OCSP. Un atacante que ha obtenido la clave privada de un certificado de respondedor OCSP designado por CA caducado puede falsificar respuestas OCSP que Erlang/OTP acepta como válidas.\n\nEsto afecta a los clientes TLS que utilizan OCSP stapling a través de la aplicación ssl: un servidor malicioso o comprometido puede presentar un certificado TLS revocado junto con una respuesta OCSP falsificada firmada por una clave de respondedor caducada, y el cliente aceptará el certificado revocado como válido. También afecta a las aplicaciones que llaman directamente a public_key:pkix_ocsp_validate/5, donde el impacto depende del caso de uso - la validación de certificados de cliente del lado del servidor que utiliza esta API puede permitir la omisión de autenticación con un certificado de cliente revocado.\n\nEste problema afecta a OTP desde OTP 27.0 antes de OTP 27.3.4.12, 28.5.0.1 y 29.0.1 correspondiente a public_key desde 1.16 antes de 1.17.1.3, 1.20.3.1 y 1.21.1."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unknown",
"packageName": "public_key",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"pubkey_ocsp"
],
"programFiles": [
"src/pubkey_ocsp.erl"
],
"programRoutines": [
{
"name": "pubkey_ocsp:verify_response/5"
},
{
"name": "pubkey_ocsp:is_authorized_responder/3"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"versions": [
{
"version": "1.16",
"lessThan": "*",
"versionType": "otp",
"status": "affected",
"changes": [
{
"at": "1.17.1.3",
"status": "unaffected"
},
{
"at": "1.20.3.1",
"status": "unaffected"
},
{
"at": "1.21.1",
"status": "unaffected"
}
]
}
]
},
{
"vendor": "Erlang",
"product": "OTP",
"defaultStatus": "unknown",
"collectionURL": "https://github.com",
"packageName": "erlang/otp",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"modules": [
"pubkey_ocsp"
],
"programFiles": [
"lib/public_key/src/pubkey_ocsp.erl"
],
"programRoutines": [
{
"name": "pubkey_ocsp:verify_response/5"
},
{
"name": "pubkey_ocsp:is_authorized_responder/3"
}
],
"repo": "https://github.com/erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"versions": [
{
"version": "27.0",
"lessThan": "*",
"versionType": "otp",
"status": "affected",
"changes": [
{
"at": "27.3.4.12",
"status": "unaffected"
},
{
"at": "28.5.0.1",
"status": "unaffected"
},
{
"at": "29.0.1",
"status": "unaffected"
}
]
},
{
"version": "2b1a742c651b90f8a7a1fb2ddde73f29915ea376",
"lessThan": "*",
"versionType": "git",
"status": "affected",
"changes": [
{
"at": "7995f1fdaee3da569bb810358ce0f546471d169b",
"status": "unaffected"
},
{
"at": "b3870e02405c709a872b01ba6086065620cdfe76",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 3.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-27T15:40:27.647844Z",
"id": "CVE-2026-42791",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-295"
},
{
"lang": "en",
"value": "CWE-672"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "27.0",
"versionEndExcluding": "27.3.4.12",
"matchCriteriaId": "91269F6D-B8A3-41F2-871C-79EBB9460BE8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "28.0",
"versionEndExcluding": "28.5.0.1",
"matchCriteriaId": "844A3F01-AF3C-4C48-81DB-932B803D22C4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "29.0",
"versionEndExcluding": "29.0.1",
"matchCriteriaId": "46976598-817C-4E93-AC4B-46434746C25F"
}
]
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-42791.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://github.com/erlang/otp/commit/7995f1fdaee3da569bb810358ce0f546471d169b",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/erlang/otp/commit/b3870e02405c709a872b01ba6086065620cdfe76",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/erlang/otp/security/advisories/GHSA-cjxj-wj6x-3fff",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-42791",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Product"
]
}
]
}