Improper Certificate Validation in Erlang OTP Affecting Public_key Module

CVE-2026-32144

What is CVE-2026-32144?

A vulnerability in the public_key module of Erlang OTP allows for OCSP designated-responder authorization bypass due to inadequate signature verification. The current check only compares the responder's issuer name with the CA's subject name and verifies that the certificate has the OCSPSigning extended key usage. This weakness enables attackers who can intercept OCSP responses to forge valid responses for revoked certificates using self-signed certificates, thereby compromising the integrity of SSL/TLS connections. Applications relying on the affected API could unintentionally accept connections to untrustworthy servers and expose sensitive data.

References