# CVE-2026-32144: Erlang OTP auth bypass in OCSP responder validation

Source: https://junglewise.ai/threats/cve-2026-32144-erlang-otp-auth-bypass-in-ocsp-responder-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-32144 · Severity: high · CVSS 7.4 · Published 2026-04-07

A security flaw in Erlang's core networking libraries could allow attackers to bypass certificate revocation checks. This affects applications using SSL/TLS with OCSP stapling, potentially allowing a user to connect to a malicious or compromised server that is using a revoked security certificate. This could lead to the interception of sensitive data or unauthorized access to communications.

## Quick answers

**Is CVE-2026-32144 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32144 being exploited in the wild.

**How severe is CVE-2026-32144?** High severity, with a CVSS score of 7.4, published 7 April 2026.

**Which products and versions are affected?** Erlang OTP 27.0 to 28.4.2, 27.3.4.10; Erlang public_key 1.16 to 1.20.3, 1.17.1.2; Erlang ssl 11.2 to 11.5.4, 11.2.12.7.

**Is there a fix for CVE-2026-32144?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-32144 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-32144?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The OCSP response validation in Erlang's 'public_key:pkix_ocsp_validate/5' function fails to verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. The implementation only checks for a matching issuer name and the 'OCSPSigning' extended key usage (EKU). An attacker capable of intercepting or controlling OCSP responses can provide a self-signed certificate with matching metadata to forge responses, effectively marking revoked certificates as valid. This affects SSL/TLS clients using OCSP stapling and applications directly calling the affected API. Patches are available in OTP versions 28.4.2 and 27.3.4.10.

## Affected products

- Erlang OTP 27.0 to 28.4.2, 27.3.4.10
- Erlang public_key 1.16 to 1.20.3, 1.17.1.2
- Erlang ssl 11.2 to 11.5.4, 11.2.12.7

## Timeline

- 2026-04-07: advisory: Initial publication of CVE-2026-32144
- 2026-04-07: disclosed

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-32144.html](https://cna.erlef.org/cves/CVE-2026-32144.html)
- [https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0](https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0)
- [https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891](https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891)
- [https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm](https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)