Improper Certificate Validation in Erlang OTP's public_key Module

CVE-2026-42791

What is CVE-2026-42791?

In Erlang OTP, a vulnerability exists within the public_key module's OCSP functionality. It fails to validate the time constraints of OCSP responder certificates, allowing attackers to create forged OCSP responses using expired certificates. This could mislead TLS clients into accepting revoked certificates as valid when OCSP stapling is used, potentially compromising secure connections. Affected versions of OTP include 27.0 up to 27.3.4.12, along with subsequent versions in the 28.x and 29.x series. This issue flags a significant risk for authentication processes, particularly in server-side validations.

References