Erlang/OTP -- public_key accepts non-CA certificate as intermediate issuer

2026-05-28 · CVE-2026-42789 · VuXML entry

https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq reports: Erlang/OTP's public_key application contains a path-validation flaw where non-CA certificates lacking keyUsage extensions can be accepted as intermediate issuers. An attacker with an end-entity certificate issued by a trusted CA can exploit this to forge arbitrary leaf certificates, allowing public_key:pkix_path_validation/3 to validate …

Affected versions

• erlang >= 17.0,3 < 26.2.5.21,4
• erlang-runtime27 < 27.3.4.12
• erlang-runtime28 < 28.5.0.1
• erlang-runtime29 < 29.0.1

By system

3 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.