Junglewise Threat Intelligence

CVE-2026-42789: Erlang OTP certificate chain forgery in public_key library

CVE-2026-42789 · Severity: info · CVSS 7 · Published 2026-05-27

Technologies: Erlang Public Key, Erlang OTP. Vendors: Erlang.

Executive brief

A vulnerability in Erlang's security library allows standard digital certificates to be used as if they were Certificate Authorities. This means an attacker with a valid personal or device certificate can create fake certificates for any website or user, potentially bypassing encryption protections in applications built with Erlang or Elixir. This affects secure communications (TLS) and identity verification systems, allowing attackers to impersonate trusted services or intercept private data.

Technical details

A vulnerability exists in the pubkey_cert:validate_extensions/7 function within Erlang's public_key library. The implementation fails to reject certificates in the issuer position when basicConstraints is set to cA:false, and it bypasses keyCertSign enforcement if the keyUsage extension is entirely absent. An attacker possessing a leaf certificate with these specific properties (common in internal PKIs or IoT deployments) can sign forged certificates for any identity. These forged certificates will be incorrectly validated by public_key:pkix_path_validation/3, impacting all Erlang-based TLS clients and mTLS servers. Patches are available in OTP versions 26.2.5.21, 27.3.4.12, 28.5.0.1, and 29.0.1.

Affected products

  • Erlang OTP 17.0 to 26.2.5.20, 27.0 to 27.3.4.11, 28.0 to 28.5.0.0, 29.0.0
  • Erlang public_key 0.22 to 1.15.1.6, 1.17.1.2, 1.20.3.0, 1.21.0

Timeline

  • 2026-05-27: disclosed
  • 2026-05-27: advisory

References

Related threats