# CVE-2026-42789: Erlang OTP certificate chain forgery in public_key library

Source: https://junglewise.ai/threats/cve-2026-42789-erlang-otp-certificate-chain-forgery-in-public-key-library  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-42789 · Severity: info · CVSS 7 · Published 2026-05-27

A vulnerability in Erlang's security library allows standard digital certificates to be used as if they were Certificate Authorities. This means an attacker with a valid personal or device certificate can create fake certificates for any website or user, potentially bypassing encryption protections in applications built with Erlang or Elixir. This affects secure communications (TLS) and identity verification systems, allowing attackers to impersonate trusted services or intercept private data.

Technologies: [Erlang OTP](https://junglewise.ai/threats/technologies/otp), [Erlang Public Key](https://junglewise.ai/threats/technologies/public-key). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-42789 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42789 being exploited in the wild.

**How severe is CVE-2026-42789?** Informational severity, with a CVSS score of 7, published 27 May 2026.

**Which products and versions are affected?** Erlang OTP 17.0 to 26.2.5.20, 27.0 to 27.3.4.11, 28.0 to 28.5.0.0, 29.0.0; Erlang Public Key 0.22 to 1.15.1.6, 1.17.1.2, 1.20.3.0, 1.21.0.

**Is there a fix for CVE-2026-42789?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42789 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42789?** Check whether you run Erlang OTP or Erlang Public Key at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the pubkey_cert:validate_extensions/7 function within Erlang's public_key library. The implementation fails to reject certificates in the issuer position when basicConstraints is set to cA:false, and it bypasses keyCertSign enforcement if the keyUsage extension is entirely absent. An attacker possessing a leaf certificate with these specific properties (common in internal PKIs or IoT deployments) can sign forged certificates for any identity. These forged certificates will be incorrectly validated by public_key:pkix_path_validation/3, impacting all Erlang-based TLS clients and mTLS servers. Patches are available in OTP versions 26.2.5.21, 27.3.4.12, 28.5.0.1, and 29.0.1.

## Affected products

- Erlang OTP 17.0 to 26.2.5.20, 27.0 to 27.3.4.11, 28.0 to 28.5.0.0, 29.0.0
- Erlang public_key 0.22 to 1.15.1.6, 1.17.1.2, 1.20.3.0, 1.21.0

## Timeline

- 2026-05-27: disclosed
- 2026-05-27: advisory

## References

- [https://cna.erlef.org/cves/CVE-2026-42789.html](https://cna.erlef.org/cves/CVE-2026-42789.html)
- [https://github.com/erlang/otp/commit/471cd2f664300a95353c467873800bbe706005db](https://github.com/erlang/otp/commit/471cd2f664300a95353c467873800bbe706005db)
- [https://github.com/erlang/otp/commit/59c8d824386b2eb1614ff9340624843ef6aca0fd](https://github.com/erlang/otp/commit/59c8d824386b2eb1614ff9340624843ef6aca0fd)
- [https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq](https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)