Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certifi…
Summary
Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Lint boundary warnings (1)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://www.erlang.org/doc/system/versions.html#order-of-versions
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-42789.html Third Party Advisory
- https://github.com/erlang/otp/commit/471cd2f664300a95353c467873800bbe706005db Patch
- https://github.com/erlang/otp/commit/59c8d824386b2eb1614ff9340624843ef6aca0fd Patch
- https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-42789 Third Party Advisory
- https://www.erlang.org/doc/system/versions.html#order-of-versions Product
- https://access.redhat.com/errata/RHSA-2026:39809
- https://access.redhat.com/security/cve/CVE-2026-42789
- https://bugzilla.redhat.com/show_bug.cgi?id=2482093
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42789.json
Timeline
- nvd_ingest NVD