CVE-2026-42789

{"id": "CVE-2026-42789", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42789", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T15:41:47.903975Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "modules": ["pubkey_cert"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "27.3.4.19", "status": "unaffected"}, {"at": "28.5.0.8", "status": "unaffected"}, {"at": "29.1.2", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["lib/public_key/src/pubkey_cert.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_cert"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "1.17.1.7", "status": "unaffected"}, {"at": "1.20.3.6", "status": "unaffected"}, {"at": "1.21.8", "status": "unaffected"}], "version": "0.22", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "public_key", "programFiles": ["src/pubkey_cert.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_cert"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "status": "unaffected"}, {"at": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "status": "unaffected"}, {"at": "82af606b5437c4de1276dbcc8855a47e88231226", "status": "unaffected"}], "version": "84adefa331c4159d432d22840663c38f155cd4c1", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "82af606b5437c4de1276dbcc8855a47e88231226", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/public_key/src/pubkey_cert.erl"], "collectionURL": "https://github.com", "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_cert:validate_extensions/7"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:openstack:16.2::el8"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 16.2", "versions": [{"status": "unaffected", "version": "0:23.3.4.18-2.el8ost", "lessThan": "*", "versionType": "rpm"}], "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:18.0::el9"], "vendor": "Red Hat", "product": "Red Hat OpenStack Services on OpenShift 18.0", "versions": [{"status": "unaffected", "version": "0:26.2.5.21-2.el9ost", "lessThan": "*", "versionType": "rpm"}], "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "erlang27", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openstack:17.1"], "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "packageName": "erlang", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-05-27T14:16:53.267", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-42789.html", "tags": ["Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/erlang/otp/commit/0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/erlang/otp/commit/75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/erlang/otp/commit/82af606b5437c4de1276dbcc8855a47e88231226", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq", "tags": ["Vendor Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-42789", "tags": ["Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "tags": ["Product"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://access.redhat.com/errata/RHSA-2026:39809", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54757", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-42789", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482093", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42789.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-296"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.\n\nIn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.\n\nAny party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.19, OTP\u00a028.5.0.8, and OTP\u00a029.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP\u00a017.0, corresponding to public_key before 0.22, is affected is unknown."}, {"lang": "es", "value": "Vulnerabilidad de seguimiento incorrecto de la cadena de confianza de un certificado en Erlang OTP public_key (m\u00f3dulo pubkey_cert) permite que un certificado que no es de CA sea aceptado como emisor intermedio, lo que posibilita la falsificaci\u00f3n de la cadena de certificados.\n\nEn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contiene dos fallos que juntos permiten que un certificado con basicConstraints cA:false y sin extensi\u00f3n keyUsage sea utilizado como emisor intermedio en una cadena pasada a public_key:pkix_path_validation/3: la cl\u00e1usula cA:false recurre en las extensiones restantes sin rechazar el certificado cuando est\u00e1 en posici\u00f3n de emisor, y la verificaci\u00f3n de keyUsage solo se activa cuando la extensi\u00f3n est\u00e1 presente, por lo que un certificado que carece de keyUsage elude completamente la aplicaci\u00f3n de keyCertSign.\n\nCualquier parte que posea un certificado de entidad final con basicConstraints cA:false y sin extensi\u00f3n keyUsage, emitido por cualquier CA en el almac\u00e9n de confianza de la v\u00edctima, puede usar la clave privada de ese certificado para firmar certificados hoja falsificados para identidades arbitrarias. public_key:pkix_path_validation/3 acepta la cadena resultante, y por extensi\u00f3n, cada endpoint TLS o mTLS construido sobre la aplicaci\u00f3n OTP ssl que depende del verificador predeterminado se ve afectado, incluyendo la verificaci\u00f3n de identidad del servidor en el lado del cliente y la verificaci\u00f3n de certificados del cliente en servidores mTLS.\n\nEste problema afecta a OTP desde la versi\u00f3n OTP 17.0 hasta versiones anteriores a la OTP 27.3.4.19, as\u00ed como a las versiones OTP 28.5.0.8 y OTP 29.1.2, lo que corresponde a public_key desde la versi\u00f3n 0.22 hasta versiones anteriores a la 1.17.1.7, as\u00ed como a las versiones 1.20.3.6 y 1.21.8. Se desconoce si OTP en versiones anteriores a la OTP 17.0, lo que corresponde a public_key en versiones anteriores a la 0.22, se ve afectado."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F25CA266-A367-4D08-8717-0D1A6694DBDC", "versionEndExcluding": "26.2.5.21", "versionStartIncluding": "17.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91269F6D-B8A3-41F2-871C-79EBB9460BE8", "versionEndExcluding": "27.3.4.12", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "844A3F01-AF3C-4C48-81DB-932B803D22C4", "versionEndExcluding": "28.5.0.1", "versionStartIncluding": "28.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46976598-817C-4E93-AC4B-46434746C25F", "versionEndExcluding": "29.0.1", "versionStartIncluding": "29.0"}], "operator": "OR"}]}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}