CVE-2026-32144

{"id": "CVE-2026-32144", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32144", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T13:15:14.355759Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_ocsp"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "1.20.3", "status": "unaffected"}, {"at": "1.17.1.2", "status": "unaffected"}], "version": "1.16", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "public_key", "programFiles": ["src/pubkey_ocsp.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["ssl_stapling"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "11.5.4", "status": "unaffected"}, {"at": "11.2.12.7", "status": "unaffected"}], "version": "11.2", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "ssl", "programFiles": ["src/ssl_stapling.erl"], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_ocsp"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "28.4.2", "status": "unaffected"}, {"at": "27.3.4.10", "status": "unaffected"}], "version": "27.0", "lessThan": "*", "versionType": "otp"}, {"status": "affected", "changes": [{"at": "ac7ff528be857c5d35eb29c7f24106e3a16d4891", "status": "unaffected"}, {"at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0", "status": "unaffected"}], "version": "601a012837ea0a5c8095bf24223132824177124d", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/public_key/src/pubkey_ocsp.erl"], "collectionURL": "https://github.com", "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:openstack:16.2"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:18.0"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 18.0", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-04-07T13:16:46.570", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-32144.html", "tags": ["Mitigation", "Vendor Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0", "tags": ["Patch"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891", "tags": ["Patch"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm", "tags": ["Mitigation", "Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32144", "tags": ["Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "tags": ["Vendor Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-32144", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455896", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32144.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP 27.0 before OTP\u00a028.4.2 and OTP\u00a027.3.4.10, corresponding to public_key from 1.16 before 1.20.3 and 1.17.1.2, and ssl from 11.2 before 11.5.4 and 11.2.12.7."}, {"lang": "es", "value": "Vulnerabilidad de validaci\u00f3n de certificado incorrecta en Erlang OTP public_key (m\u00f3dulo pubkey_ocsp) permite la omisi\u00f3n de autorizaci\u00f3n de respondedor designado de OCSP a trav\u00e9s de la verificaci\u00f3n de firma faltante.\n\nLa validaci\u00f3n de respuesta OCSP en public_key:pkix_ocsp_validate/5 no verifica que un certificado de respondedor designado por CA fue firmado criptogr\u00e1ficamente por la CA emisora. En su lugar, solo verifica que el nombre del emisor del certificado del respondedor coincide con el nombre del sujeto de la CA y que el certificado tiene el uso de clave extendido OCSPSigning. Un atacante que puede interceptar o controlar respuestas OCSP puede crear un certificado autofirmado con un nombre de emisor coincidente y el EKU OCSPSigning, y usarlo para falsificar respuestas OCSP que marcan certificados revocados como v\u00e1lidos.\n\nEsto afecta a los clientes SSL/TLS que usan OCSP stapling, lo que puede aceptar conexiones a servidores con certificados revocados, potencialmente transmitiendo datos sensibles a servidores comprometidos. Las aplicaciones que usan la API public_key:pkix_ocsp_validate/5 directamente tambi\u00e9n se ven afectadas, con impacto dependiendo del contexto de uso.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/public_key/src/pubkey_ocsp.erl y las rutinas de programa pubkey_ocsp:is_authorized_responder/3.\n\nEste problema afecta a OTP desde OTP 27.0 hasta OTP 28.4.2 y 27.3.4.10 correspondiente a public_key desde 1.16 hasta 1.20.3 y 1.17.1.2, y ssl desde 11.2 hasta 11.5.4 y 11.2.12.7."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2771D519-4124-4D3F-A8E0-3E4704973B3E", "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2E111DA-579A-438F-A2FF-5799B01AF401", "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/public_key:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "459DB53B-9049-48D3-86F9-5CB3286BDCFB", "versionEndExcluding": "1.17.1.2", "versionStartIncluding": "1.16"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/public_key:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F0812B0-29FA-4EAB-B557-5FB6C8D2D581", "versionEndExcluding": "1.20.3", "versionStartIncluding": "1.18"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDA65CE8-5C84-4EAE-8709-44240FB9E2A1", "versionEndExcluding": "11.2.12.7", "versionStartIncluding": "11.2"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C64F6749-FB4F-4757-B9B9-540612B69606", "versionEndExcluding": "11.5.4", "versionStartExcluding": "11.3"}], "operator": "OR"}]}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}