UpHeron
All vulnerabilities

Servers and applications

CVE-2026-42789

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage…

Severity
High 7.0
Published
27 May 2026
Last changed
14 Oct 2026
Added to UpHeron
16 Oct 2026
Fixed in
26.2.5.21, 27.3.4.12, 28.5.0.1, 29.0.1
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 17.0 before 26.2.5.21
  • From 27.0 before 27.3.4.12
  • From 28.0 before 28.5.0.1
  • From 29.0 before 29.0.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-42789
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-42789