BSD PortsErlang/OTP -- TLS hostname verification bypass via Subject CommonName fallback and name constraints
· CVE-2026-42790 · VuXML entry
https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447 reports: Erlang/OTP's TLS hostname verification implements a legacy RFC 6125 fallback that checks the Subject CommonName when the Subject Alternative Name (SAN) extension is absent, rather than following RFC 9525 which requires validation to fail without SAN. Combined with weak handling of X.509 Name Constraints, this enables man-in-the-middle …
Affected versions
- erlang >= 19.3,3 < 26.2.5.21,4
- erlang-runtime27 < 27.3.4.12
- erlang-runtime28 < 28.5.0.1
- erlang-runtime29 < 29.0.1
By system
3 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/erlang | 25.3.2.7_1,4 | vulnerable since 2026-05-28 | |
| NetBSD | lang/erlang | 27.3.4.7 | not listed | |
| MidnightBSD | lang/erlang | 25.3.2.20_1,4 | in range, by version | |
| FreeBSD | lang/erlang | 28.5.0.8_1,4 | fixed | (61 days after) |
| DragonFly | lang/erlang-runtime27 | 27.3.4 | vulnerable since 2026-05-28 | |
| FreeBSD | lang/erlang-runtime27 | 27.3.4.19_1 | fixed | (61 days after) |
| DragonFly | lang/erlang-runtime28 | 28.0 | vulnerable since 2026-05-28 | |
| MidnightBSD | lang/erlang-runtime28 | 28.5.0.8 | out of range, by version | |
| FreeBSD | lang/erlang-runtime28 | 28.5.0.8_1 | fixed | (61 days after) |
| FreeBSD | lang/erlang-runtime29 | 29.1.2_1 | fixed | (36 days after) |