Erlang/OTP -- OCSP responder certificate accepted after expiry in public_key

2026-05-28 · CVE-2026-42791 · VuXML entry

https://github.com/erlang/otp/security/advisories/GHSA-cjxj-wj6x-3fff reports: Erlang/OTP's public_key application fails to validate the validity period of OCSP responder certificates during response verification. An attacker possessing an expired OCSP responder's private key can forge responses that the system accepts as valid, potentially allowing acceptance of revoked TLS certificates in OCSP stapling scenarios …

Affected versions

• erlang-runtime27 < 27.3.4.12
• erlang-runtime28 < 28.5.0.1
• erlang-runtime29 < 29.0.1

By system

2 still vulnerable, 3 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.