# CVE-2026-42791: Erlang OTP improper certificate validation in public_key OCSP module

Source: https://junglewise.ai/threats/cve-2026-42791-erlang-otp-improper-certificate-validation-in-public-key-ocsp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-42791 · Severity: info · CVSS 6.3 · Published 2026-05-27

A vulnerability in Erlang/OTP's security library allows the system to accept expired security credentials when checking if a digital certificate is still valid. This could allow a malicious server to trick a user's application into accepting a revoked or untrustworthy connection. In some cases, this may lead to an authentication bypass where unauthorized users gain access using revoked credentials.

Technologies: [Erlang OTP](https://junglewise.ai/threats/technologies/otp), [Erlang Public Key](https://junglewise.ai/threats/technologies/public-key). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-42791 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42791 being exploited in the wild.

**How severe is CVE-2026-42791?** Informational severity, with a CVSS score of 6.3, published 27 May 2026.

**Which products and versions are affected?** Erlang OTP 27.0 before 27.3.4.12, 28.5.0.1, 29.0.1; Erlang Public Key 1.16 before 1.17.1.3, 1.20.3.1, 1.21.1.

**Is there a fix for CVE-2026-42791?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42791 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42791?** Check whether you run Erlang OTP or Erlang Public Key at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper certificate validation vulnerability exists in the Erlang/OTP public_key application, specifically within the pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 functions. The implementation fails to check the notBefore and notAfter validity periods of OCSP responder certificates. An attacker possessing the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that the library accepts as valid. This allows a malicious server to present a revoked TLS certificate alongside a forged 'good' OCSP staple, or potentially bypass server-side client certificate authentication. The issue is fixed in OTP versions 27.3.4.12, 28.5.0.1, and 29.0.1.

## Affected products

- Erlang OTP 27.0 before 27.3.4.12, 28.5.0.1, 29.0.1
- Erlang public_key 1.16 before 1.17.1.3, 1.20.3.1, 1.21.1

## Timeline

- 2026-05-27: disclosed
- 2026-05-27: advisory

## References

- [https://cna.erlef.org/cves/CVE-2026-42791.html](https://cna.erlef.org/cves/CVE-2026-42791.html)
- [https://github.com/erlang/otp/commit/7995f1fdaee3da569bb810358ce0f546471d169b](https://github.com/erlang/otp/commit/7995f1fdaee3da569bb810358ce0f546471d169b)
- [https://github.com/erlang/otp/commit/b3870e02405c709a872b01ba6086065620cdfe76](https://github.com/erlang/otp/commit/b3870e02405c709a872b01ba6086065620cdfe76)
- [https://github.com/erlang/otp/security/advisories/GHSA-cjxj-wj6x-3fff](https://github.com/erlang/otp/security/advisories/GHSA-cjxj-wj6x-3fff)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)