UpHeron
All vulnerabilities

Servers and applications

CVE-2026-42790

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a…

Severity
High 7.6
Published
27 May 2026
Last changed
18 Sept 2026
Added to UpHeron
16 Oct 2026
Fixed in
26.2.5.21, 27.3.4.12, 28.5.0.1, 29.0.1
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 19.3 before 26.2.5.21
  • From 27.0 before 27.3.4.12
  • From 28.0 before 28.5.0.1
  • From 29.0 before 29.0.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-42790
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-42790