Improper validation of certificate with host mismatch in Erlang OTP - CVE-2026-42790

Vulnerability identifier: #VU136813

CSH Severity: Medium

CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42790

CWE-ID: CWE-297

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass certificate hostname validation.

The vulnerability exists due to improper validation of certificate with host mismatch in public_key:pkix_verify_hostname/3 when processing TLS certificates that lack a Subject Alternative Name extension or contain no domain name in that extension. A remote attacker can present a specially crafted certificate during a man-in-the-middle position to bypass certificate hostname validation.

Exploitation requires the ability to intercept network traffic and, in the worst case, control a DNS-constrained sub-CA key.

Erlang OTP
Debian Linux
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
erlang-reltool
erlang-epmd-debuginfo
erlang-debugsource
erlang
erlang-epmd
erlang-debuginfo
erlang-dialyzer
erlang-wx-debuginfo
erlang-debugger-src
erlang-diameter
erlang-et-src
erlang-dialyzer-debuginfo
erlang-et
erlang-reltool-src
erlang-jinterface-src
erlang-diameter-src
erlang-doc
erlang-src
erlang-observer-src
erlang-jinterface
erlang-dialyzer-src
erlang-wx-src
erlang-debugger
erlang-observer
erlang-wx
erlang26-et-src
erlang26-jinterface-src
erlang26-epmd
erlang26-jinterface
erlang26-wx-src
erlang26-dialyzer-src
erlang26-diameter-src
erlang26-wx
erlang26-et
erlang26-debugger
erlang26-reltool-src
erlang26-reltool
erlang26-debugger-src
erlang26-dialyzer-debuginfo
erlang26-debugsource
erlang26-epmd-debuginfo
erlang26-doc
erlang26-diameter
erlang26-wx-debuginfo
erlang26-observer-src
erlang26-src
erlang26-debuginfo
erlang26-observer
erlang26-dialyzer
erlang26
erlang (Red Hat package)
erlang (Debian package)

Install security update from vendor's website.

Erlang OTP - addressed in versions 26.2.5.21, 27.3.4.12, 28.5.0.1, 29.0.1
erlang-reltool - update to 23.3.4.19-150300.3.39.1
erlang-epmd-debuginfo - update to 23.3.4.19-150300.3.39.1
erlang-debugsource - update to 23.3.4.19-150300.3.39.1
erlang - update to 23.3.4.19-150300.3.39.1
erlang-epmd - update to 23.3.4.19-150300.3.39.1
erlang-debuginfo - update to 23.3.4.19-150300.3.39.1
erlang-dialyzer - update to 23.3.4.19-150300.3.39.1
erlang-wx-debuginfo - update to 23.3.4.19-150300.3.39.1
erlang-debugger-src - update to 23.3.4.19-150300.3.39.1
erlang-diameter - update to 23.3.4.19-150300.3.39.1
erlang-et-src - update to 23.3.4.19-150300.3.39.1
erlang-dialyzer-debuginfo - update to 23.3.4.19-150300.3.39.1
erlang-et - update to 23.3.4.19-150300.3.39.1
erlang-reltool-src - update to 23.3.4.19-150300.3.39.1
erlang-jinterface-src - update to 23.3.4.19-150300.3.39.1
erlang-diameter-src - update to 23.3.4.19-150300.3.39.1
erlang-doc - update to 23.3.4.19-150300.3.39.1
erlang-src - update to 23.3.4.19-150300.3.39.1
erlang-observer-src - update to 23.3.4.19-150300.3.39.1
erlang-jinterface - update to 23.3.4.19-150300.3.39.1
erlang-dialyzer-src - update to 23.3.4.19-150300.3.39.1
erlang-wx-src - update to 23.3.4.19-150300.3.39.1
erlang-debugger - update to 23.3.4.19-150300.3.39.1
erlang-observer - update to 23.3.4.19-150300.3.39.1
erlang-wx - update to 23.3.4.19-150300.3.39.1
erlang26-et-src - update to 26.2.1-150300.7.28.1
erlang26-jinterface-src - update to 26.2.1-150300.7.28.1
erlang26-epmd - update to 26.2.1-150300.7.28.1
erlang26-jinterface - update to 26.2.1-150300.7.28.1
erlang26-wx-src - update to 26.2.1-150300.7.28.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.28.1
erlang26-diameter-src - update to 26.2.1-150300.7.28.1
erlang26-wx - update to 26.2.1-150300.7.28.1
erlang26-et - update to 26.2.1-150300.7.28.1
erlang26-debugger - update to 26.2.1-150300.7.28.1
erlang26-reltool-src - update to 26.2.1-150300.7.28.1
erlang26-reltool - update to 26.2.1-150300.7.28.1
erlang26-debugger-src - update to 26.2.1-150300.7.28.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-debugsource - update to 26.2.1-150300.7.28.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-doc - update to 26.2.1-150300.7.28.1
erlang26-diameter - update to 26.2.1-150300.7.28.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-observer-src - update to 26.2.1-150300.7.28.1
erlang26-src - update to 26.2.1-150300.7.28.1
erlang26-debuginfo - update to 26.2.1-150300.7.28.1
erlang26-observer - update to 26.2.1-150300.7.28.1
erlang26-dialyzer - update to 26.2.1-150300.7.28.1
erlang26 - update to 26.2.1-150300.7.28.1
erlang (Red Hat package) - update to 26.2.5.21-2.el9ost
erlang (Debian package) - update to 1:27.3.4.1+dfsg-1+deb13u3

• https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447

• Multiple vulnerabilities in otp
• Red Hat OpenStack Services onOpenShift 18 update for erlang
• Debian update for erlang
• SUSE update for erlang26
• SUSE update for erlang