Improper Certificate Chain Handling in Erlang OTP's public_key Module

CVE-2026-42789

What is CVE-2026-42789?

The vulnerability affects Erlang OTP's public_key module, allowing non-CA certificates with basicConstraints set to cA:false and lacking the keyUsage extension to be wrongly accepted as intermediate issuers. This flaw permits the signing of forged leaf certificates for any identity, creating a risk for systems that depend on TLS or mTLS. Dependencies on the public_key:pkix_path_validation/3 function are particularly vulnerable, impacting server and client identity verifications across various endpoints. Versions prior to specified updates are at risk, making it crucial for users to implement available patches promptly.

References