{"id":"CVE-2026-42789","revision":null,"records":[{"revision":"2b82851885b442b4a6c72818b10d05b9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-42789","aliases":[],"title":"Non-CA certificate accepted as intermediate issuer in public_key path validation","description":"Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.\n\nIn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.\n\nAny party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.\n\nThis issue affects OTP from OTP\u00A017.0 before OTP\u00A027.3.4.19, OTP\u00A028.5.0.8, and OTP\u00A029.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP\u00A017.0, corresponding to public_key before 0.22, is affected is unknown.","state":0,"publishedAt":"2026-05-27T12:23:06.355+00:00","modifiedAt":"2026-10-14T16:55:37.359+00:00","affected":[{"ecosystem":"Vendor product","name":"otp","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"cpes\": [\n \"cpe:2.3:a:erlang:erlang\\\\/otp:*:*:*:*:*:*:*:*\"\n ],\n \"defaultStatus\": \"unknown\",\n \"modules\": [\n \"pubkey_cert\"\n ],\n \"packageName\": \"otp\",\n \"packageURL\": \"pkg:software-id/erlang.org/otp\",\n \"product\": \"OTP\",\n \"programFiles\": [\n \"lib/public_key/src/pubkey_cert.erl\"\n ],\n \"programRoutines\": [\n {\n \"name\": \"pubkey_cert:validate_extensions/7\"\n }\n ],\n \"vendor\": \"Erlang\",\n \"versions\": [\n {\n \"changes\": [\n {\n \"at\": \"27.3.4.19\",\n \"status\": \"unaffected\"\n },\n {\n \"at\": \"28.5.0.8\",\n \"status\": \"unaffected\"\n },\n {\n \"at\": \"29.1.2\",\n \"status\": \"unaffected\"\n }\n ],\n \"lessThan\": \"*\",\n \"status\": \"affected\",\n \"version\": \"17.0\",\n \"versionType\": \"otp\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"public_key","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"cpes\": [\n \"cpe:2.3:a:erlang:erlang\\\\/otp:*:*:*:*:*:*:*:*\"\n ],\n \"defaultStatus\": \"unknown\",\n \"modules\": [\n \"pubkey_cert\"\n ],\n \"packageName\": \"public_key\",\n \"packageURL\": \"pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git\",\n \"product\": \"OTP\",\n \"programFiles\": [\n \"src/pubkey_cert.erl\"\n ],\n \"programRoutines\": [\n {\n \"name\": \"pubkey_cert:validate_extensions/7\"\n }\n ],\n \"repo\": \"https://github.com/erlang/otp\",\n \"vendor\": \"Erlang\",\n \"versions\": [\n {\n \"changes\": [\n {\n \"at\": \"1.17.1.7\",\n \"status\": \"unaffected\"\n },\n {\n \"at\": \"1.20.3.6\",\n \"status\": \"unaffected\"\n },\n {\n \"at\": \"1.21.8\",\n \"status\": \"unaffected\"\n }\n ],\n \"lessThan\": \"*\",\n \"status\": \"affected\",\n \"version\": \"0.22\",\n \"versionType\": \"otp\"\n }\n ]\n }"},{"ecosystem":"https://github.com","name":"erlang/otp","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"collectionURL\": \"https://github.com\",\n \"cpes\": [\n \"cpe:2.3:a:erlang:erlang\\\\/otp:*:*:*:*:*:*:*:*\"\n ],\n \"defaultStatus\": \"unknown\",\n \"modules\": [\n \"pubkey_cert\"\n ],\n \"packageName\": \"erlang/otp\",\n \"packageURL\": \"pkg:github/erlang/otp\",\n \"product\": \"OTP\",\n \"programFiles\": [\n \"lib/public_key/src/pubkey_cert.erl\"\n ],\n \"programRoutines\": [\n {\n \"name\": \"pubkey_cert:validate_extensions/7\"\n }\n ],\n \"repo\": \"https://github.com/erlang/otp\",\n \"vendor\": \"Erlang\",\n \"versions\": [\n {\n \"changes\": [\n {\n \"at\": \"0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8\",\n \"status\": \"unaffected\"\n },\n {\n \"at\": \"75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333\",\n \"status\": \"unaffected\"\n },\n {\n \"at\": \"82af606b5437c4de1276dbcc8855a47e88231226\",\n \"status\": \"unaffected\"\n }\n ],\n \"lessThan\": \"*\",\n \"status\": \"affected\",\n \"version\": \"84adefa331c4159d432d22840663c38f155cd4c1\",\n \"versionType\": \"git\"\n },\n {\n \"lessThan\": \"*\",\n \"status\": \"unaffected\",\n \"version\": \"0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8\",\n \"versionType\": \"git\"\n },\n {\n \"lessThan\": \"*\",\n \"status\": \"unaffected\",\n \"version\": \"75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333\",\n \"versionType\": \"git\"\n },\n {\n \"lessThan\": \"*\",\n \"status\": \"unaffected\",\n \"version\": \"82af606b5437c4de1276dbcc8855a47e88231226\",\n \"versionType\": \"git\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N","score":7,"severity":"HIGH"}],"references":["https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq","https://cna.erlef.org/cves/CVE-2026-42789.html","https://osv.dev/vulnerability/EEF-CVE-2026-42789","https://www.erlang.org/doc/system/versions.html#order-of-versions","https://github.com/erlang/otp/commit/0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8","https://github.com/erlang/otp/commit/75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333","https://github.com/erlang/otp/commit/82af606b5437c4de1276dbcc8855a47e88231226"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42789","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-42789","identifiers":["CVE-2026-42789"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T02:02:16.7426948+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T02:02:16.7426948+00:00","lastSuccessAt":"2026-11-10T02:02:16.8834841+00:00","error":null,"lastVerifiedAt":"2026-11-10T02:02:16.8834842+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-3682c03b9a65aeeb7a6398250677204fe1fddf168002894b8519e9831c9838b3","complete":true,"records":421860,"lastAttemptAt":"2026-11-10T02:02:16.0380672+00:00","lastSuccessAt":"2026-11-10T02:02:15.9983406+00:00","error":null,"lastVerifiedAt":"2026-11-10T02:02:16.0380672+00:00","snapshotPublishedAt":"2026-11-10T01:19:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-02286c9ecb1b4e70aab201fa1ef31645","complete":false,"records":13689,"lastAttemptAt":"2026-11-10T02:14:51.2009492+00:00","lastSuccessAt":"2026-11-10T02:14:51.196+00:00","error":"18 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T02:14:51.196+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13723,"expectedIdentifiers":13742,"failedIdentifiers":18},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T02:02:16.7426948+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T02:02:16.7426948+00:00","lastSuccessAt":"2026-11-10T02:02:16.8841913+00:00","error":null,"lastVerifiedAt":"2026-11-10T02:02:16.8841914+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-af04f5d48dbb47d2bc2540f8606c2614","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T02:02:42.0606224+00:00","lastSuccessAt":"2026-11-10T02:02:42.058+00:00","error":null,"lastVerifiedAt":"2026-11-10T02:02:42.058+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13704,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T02:02:16.6874003+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T02:02:16.6874003+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T02:02:16.1998498+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T02:02:16.1998498+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-761ecc9061239b0da572dc9254c6f384c1d19339eb08408c436647a2f26129e9","complete":true,"records":3064,"lastAttemptAt":"2026-11-10T02:02:16.7001987+00:00","lastSuccessAt":"2026-11-09T17:05:03.4044794+00:00","error":null,"lastVerifiedAt":"2026-11-10T02:02:16.7001987+00:00","snapshotPublishedAt":"2026-11-09T16:33:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-de491e92084daab7829a905b7af7daf62c5cba9f53efe3052c21cec43e90d59a","complete":true,"records":231581,"lastAttemptAt":"2026-11-10T02:02:16.5833779+00:00","lastSuccessAt":"2026-11-10T01:13:21.102106+00:00","error":null,"lastVerifiedAt":"2026-11-10T02:02:16.5833779+00:00","snapshotPublishedAt":"2026-11-10T00:48:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}