SB2026070295 - Multiple vulnerabilities in otp
Published: July 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-42790)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass certificate hostname validation.
The vulnerability exists due to improper validation of certificate with host mismatch in public_key:pkix_verify_hostname/3 when processing TLS certificates that lack a Subject Alternative Name extension or contain no domain name in that extension. A remote attacker can present a specially crafted certificate during a man-in-the-middle position to bypass certificate hostname validation.
Exploitation requires the ability to intercept network traffic and, in the worst case, control a DNS-constrained sub-CA key.
2) Improper Certificate Validation (CVE-ID: CVE-2026-42789)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to spoof arbitrary certificate identities.
The vulnerability exists due to improper certificate validation in public_key:pkix_path_validation/3 when validating certificate chains. A remote user can use a non-CA end-entity certificate and its private key to forge leaf certificates for arbitrary identities to spoof arbitrary certificate identities.
Exploitation requires possession of an end-entity certificate issued by a CA in the victim's trust store where basicConstraints is set to cA:false and the keyUsage extension is absent.
3) Improper Certificate Validation (CVE-ID: CVE-2026-42791)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass certificate revocation checks.
The vulnerability exists due to improper certificate validation in public_key OCSP response verification when processing OCSP responses. A remote attacker can present a forged OCSP response signed with the private key of an expired or not-yet-valid OCSP responder certificate to bypass certificate revocation checks.
This can affect SSL/TLS clients using OCSP stapling and applications that call public_key:pkix_ocsp_validate/5 directly. Exploitation requires possession of the private key of a legitimately issued OCSP responder certificate outside its validity period and the ability to deliver the forged OCSP response to the victim.
Remediation
Install update from vendor's website.