UpHeron
All vulnerabilities

Servers and applications

CVE-2026-42791

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP…

Severity
Medium 6.3
Published
27 May 2026
Last changed
24 Jul 2026
Added to UpHeron
16 Oct 2026
Fixed in
27.3.4.12, 28.5.0.1, 29.0.1
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 27.0 before 27.3.4.12
  • From 28.0 before 28.5.0.1
  • From 29.0 before 29.0.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-42791
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-42791