{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32144", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-03-10T22:37:29.212Z", "datePublished": "2026-04-07T12:28:00.767Z", "dateUpdated": "2026-04-07T14:38:03.763Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["pubkey_ocsp"], "packageName": "public_key", "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/pubkey_ocsp.erl"], "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "1.20.3", "status": "unaffected"}, {"at": "1.17.1.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "1.16", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["ssl_stapling"], "packageName": "ssl", "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/ssl_stapling.erl"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "11.5.4", "status": "unaffected"}, {"at": "11.2.12.7", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "11.2", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["pubkey_ocsp"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/public_key/src/pubkey_ocsp.erl"], "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "28.4.2", "status": "unaffected"}, {"at": "27.3.4.10", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "27.0", "versionType": "otp"}, {"changes": [{"at": "ac7ff528be857c5d35eb29c7f24106e3a16d4891", "status": "unaffected"}, {"at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "601a012837ea0a5c8095bf24223132824177124d", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., <tt>{stapling, staple}</tt>), or the application must call <tt>public_key:pkix_ocsp_validate/5</tt> directly. OCSP stapling is disabled by default (<tt>{stapling, no_staple}</tt>)."}], "value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., {stapling, staple}), or the application must call public_key:pkix_ocsp_validate/5 directly. OCSP stapling is disabled by default ({stapling, no_staple})."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "reporter", "value": "Igor Morgenstern / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Jakub Witczak"}, {"lang": "en", "type": "remediation reviewer", "value": "Ingela Anderton Andin"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.<p>The OCSP response validation in <tt>public_key:pkix_ocsp_validate/5</tt> does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.</p><p>This affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the <tt>public_key:pkix_ocsp_validate/5</tt> API directly are also affected, with impact depending on usage context.</p><p>This vulnerability is associated with program files <tt>lib/public_key/src/pubkey_ocsp.erl</tt> and program routines <tt>pubkey_ocsp:is_authorized_responder/3</tt>.</p><p>This issue affects OTP from OTP 27.0 until OTP 28.4.2 and 27.3.4.10 corresponding to public_key from 1.16 until 1.20.3 and 1.17.1.2, and ssl from 11.2 until 11.5.4 and 11.2.12.7.</p>"}], "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP 27.0 until OTP 28.4.2 and 27.3.4.10 corresponding to public_key from 1.16 until 1.20.3 and 1.17.1.2, and ssl from 11.2 until 11.5.4 and 11.2.12.7."}], "impacts": [{"capecId": "CAPEC-459", "descriptions": [{"lang": "en", "value": "CAPEC-459 Creating a Rogue Certification Authority Certificate"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.6, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-04-07T14:38:03.763Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-32144.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32144"}, {"tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0"}], "source": {"discovery": "EXTERNAL"}, "title": "OCSP designated-responder authorization bypass via missing signature verification", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><b>For SSL users:</b></p><ul><li>Do not enable OCSP validation setting (current default is <tt>{stapling, no_staple}</tt>)</li><li>Use CRL-based revocation checking by setting the <tt>{crl_check, true}</tt> SSL option instead</li></ul><p><b>For applications using <tt>public_key:pkix_ocsp_validate/5</tt> directly:</b></p><ul><li>Pass <tt>{is_trusted_responder_fun, Fun}</tt> option with a function that validates trusted responder certificates</li><li>Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)</li></ul>"}], "value": "For SSL users:\n\n* Do not enable OCSP validation setting (current default is {stapling, no_staple})\n* Use CRL-based revocation checking by setting the {crl_check, true} SSL option instead\n\nFor applications using public_key:pkix_ocsp_validate/5 directly:\n\n* Pass {is_trusted_responder_fun, Fun} option with a function that validates trusted responder certificates\n* Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T13:15:14.355759Z", "id": "CVE-2026-32144", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T13:15:20.530Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T13:15:14.355759Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T13:15:16.503Z"}}], "cna": {"title": "OCSP designated-responder authorization bypass via missing signature verification", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Igor Morgenstern / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Jakub Witczak"}, {"lang": "en", "type": "remediation reviewer", "value": "Ingela Anderton Andin"}], "impacts": [{"capecId": "CAPEC-459", "descriptions": [{"lang": "en", "value": "CAPEC-459 Creating a Rogue Certification Authority Certificate"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_ocsp"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "1.20.3", "status": "unaffected"}, {"at": "1.17.1.2", "status": "unaffected"}], "version": "1.16", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "public_key", "programFiles": ["src/pubkey_ocsp.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["ssl_stapling"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "11.5.4", "status": "unaffected"}, {"at": "11.2.12.7", "status": "unaffected"}], "version": "11.2", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "ssl", "programFiles": ["src/ssl_stapling.erl"], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["pubkey_ocsp"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "28.4.2", "status": "unaffected"}, {"at": "27.3.4.10", "status": "unaffected"}], "version": "27.0", "lessThan": "*", "versionType": "otp"}, {"status": "affected", "changes": [{"at": "ac7ff528be857c5d35eb29c7f24106e3a16d4891", "status": "unaffected"}, {"at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0", "status": "unaffected"}], "version": "601a012837ea0a5c8095bf24223132824177124d", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/public_key/src/pubkey_ocsp.erl"], "collectionURL": "https://github.com", "defaultStatus": "unknown", "programRoutines": [{"name": "pubkey_ocsp:is_authorized_responder/3"}]}], "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-32144.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-32144", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "For SSL users:\n\n* Do not enable OCSP validation setting (current default is {stapling, no_staple})\n* Use CRL-based revocation checking by setting the {crl_check, true} SSL option instead\n\nFor applications using public_key:pkix_ocsp_validate/5 directly:\n\n* Pass {is_trusted_responder_fun, Fun} option with a function that validates trusted responder certificates\n* Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)", "supportingMedia": [{"type": "text/html", "value": "<p><b>For SSL users:</b></p><ul><li>Do not enable OCSP validation setting (current default is <tt>{stapling, no_staple}</tt>)</li><li>Use CRL-based revocation checking by setting the <tt>{crl_check, true}</tt> SSL option instead</li></ul><p><b>For applications using <tt>public_key:pkix_ocsp_validate/5</tt> directly:</b></p><ul><li>Pass <tt>{is_trusted_responder_fun, Fun}</tt> option with a function that validates trusted responder certificates</li><li>Restrict OCSP responder access to trusted endpoints via network controls (only applicable if you control the OCSP infrastructure)</li></ul>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP 27.0 until OTP 28.4.2 and 27.3.4.10 corresponding to public_key from 1.16 until 1.20.3 and 1.17.1.2, and ssl from 11.2 until 11.5.4 and 11.2.12.7.", "supportingMedia": [{"type": "text/html", "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.<p>The OCSP response validation in <tt>public_key:pkix_ocsp_validate/5</tt> does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.</p><p>This affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the <tt>public_key:pkix_ocsp_validate/5</tt> API directly are also affected, with impact depending on usage context.</p><p>This vulnerability is associated with program files <tt>lib/public_key/src/pubkey_ocsp.erl</tt> and program routines <tt>pubkey_ocsp:is_authorized_responder/3</tt>.</p><p>This issue affects OTP from OTP 27.0 until OTP 28.4.2 and 27.3.4.10 corresponding to public_key from 1.16 until 1.20.3 and 1.17.1.2, and ssl from 11.2 until 11.5.4 and 11.2.12.7.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "configurations": [{"lang": "en", "value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., {stapling, staple}), or the application must call public_key:pkix_ocsp_validate/5 directly. OCSP stapling is disabled by default ({stapling, no_staple}).", "supportingMedia": [{"type": "text/html", "value": "SSL/TLS must be configured with OCSP stapling enabled (e.g., <tt>{stapling, staple}</tt>), or the application must call <tt>public_key:pkix_ocsp_validate/5</tt> directly. OCSP stapling is disabled by default (<tt>{stapling, no_staple}</tt>).", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-04-07T14:38:03.763Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32144", "state": "PUBLISHED", "dateUpdated": "2026-04-07T14:38:03.763Z", "dateReserved": "2026-03-10T22:37:29.212Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-04-07T12:28:00.767Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "2771D519-4124-4D3F-A8E0-3E4704973B3E", "versionEndExcluding": "27.3.4.10", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2E111DA-579A-438F-A2FF-5799B01AF401", "versionEndExcluding": "28.4.2", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/public_key:*:*:*:*:*:*:*:*", "matchCriteriaId": "459DB53B-9049-48D3-86F9-5CB3286BDCFB", "versionEndExcluding": "1.17.1.2", "versionStartIncluding": "1.16", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/public_key:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F0812B0-29FA-4EAB-B557-5FB6C8D2D581", "versionEndExcluding": "1.20.3", "versionStartIncluding": "1.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDA65CE8-5C84-4EAE-8709-44240FB9E2A1", "versionEndExcluding": "11.2.12.7", "versionStartIncluding": "11.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/ssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "C64F6749-FB4F-4757-B9B9-540612B69606", "versionEndExcluding": "11.5.4", "versionStartExcluding": "11.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification.\n\nThe OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid.\n\nThis affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context.\n\nThis vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3.\n\nThis issue affects OTP from OTP 27.0 until OTP 28.4.2 and 27.3.4.10 corresponding to public_key from 1.16 until 1.20.3 and 1.17.1.2, and ssl from 11.2 until 11.5.4 and 11.2.12.7."}], "id": "CVE-2026-32144", "lastModified": "2026-04-23T17:32:55.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}, "published": "2026-04-07T13:16:46.570", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-32144.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32144"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "Erlang OTP: Erlang OTP public_key: OCSP authorization bypass and information disclosure due to missing signature verification", "id": "2455896", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455896"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["A flaw was found in Erlang OTP public_key. This improper certificate validation vulnerability allows a remote attacker to bypass Online Certificate Status Protocol (OCSP) designated-responder authorization. The vulnerability stems from missing signature verification during OCSP response validation, enabling an attacker to forge responses that mark revoked certificates as valid. Consequently, clients may accept connections to compromised servers, potentially leading to the transmission of sensitive data."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-32144", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "erlang", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-04-07T12:28:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32144\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32144\nhttps://cna.erlef.org/cves/CVE-2026-32144.html\nhttps://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0\nhttps://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891\nhttps://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm\nhttps://osv.dev/vulnerability/EEF-CVE-2026-32144\nhttps://www.erlang.org/doc/system/versions.html#order-of-versions"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.20.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "1.17.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.2.12.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "27.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "28.4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "27.3.4.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "601a012837ea0a5c8095bf24223132824177124d"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "ac7ff528be857c5d35eb29c7f24106e3a16d4891"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.20.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "1.17.1.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "11.2.12.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "27.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "28.4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "27.3.4.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "601a012837ea0a5c8095bf24223132824177124d"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "ac7ff528be857c5d35eb29c7f24106e3a16d4891"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "otp", "vendor": "erlang"}], "analysis": {"en": {"generated_at": "2026-04-08T01:54:15.797816+00:00", "value": {"mitigation_remediation": ["Upgrade Erlang/OTP to a version that includes the public_key patch (e.g., OTP 28.5 or later) along with any subsequent SSL updates (e.g., ssl 11.5.5 or later).", "If an upgrade is not immediately feasible, disable OCSP stapling in SSL by setting the {stapling, no_staple} option.", "Enable CRL\u2011based revocation checking by configuring the {crl_check, true} SSL option as an alternative to stapling.", "For applications that directly call public_key:pkix_ocsp_validate/5, supply an {is_trusted_responder_fun, Fun} option where Fun validates responder certificates against a trusted list.", "Restrict network access to OCSP responder services to trusted endpoints so that only authorized entities can provide OCSP responses."], "summary": {"action": "Immediate Patch", "impact": "Authorization bypass that permits forged OCSP responses to be accepted, allowing an attacker to trick TLS clients into using certificates that are actually revoked"}, "threat_synthesis": {"affected_systems": "The flaw affects Erlang: OTP versions from 27.0 through 28.4.2 and 27.3.4.10, which correspond to public_key releases 1.16 through 1.20.3 and 1.17.1.2, as well as ssl releases 11.2 through 11.5.4 and 11.2.12.7. No other vendors or products are listed in the CNA data.\n", "description_and_impact": "The Vulnerability OCSP designated\u2011responder authorization bypass originates from the public_key:pkix_ocsp_validate/5 function in Erlang OTP, which fails to verify that a CA\u2011designated responder certificate is cryptographically signed by its issuing CA. Instead, it only checks for a matching issuer name and the presence of the OCSPSigning extended key usage. This flaw, classified as CWE\u2011295 and CWE\u2011347, enables an attacker who can influence or intercept OCSP responses to construct a self\u2011signed responder certificate with a matching issuer name and the required EKU, thereby forging OCSP responses that falsely mark revoked certificates as valid. The consequence is that SSL/TLS clients accepting such stapled responses may establish connections to servers whose certificates have been revoked, potentially exposing sensitive data to malicious servers.\n", "risk_and_exploitability": "With a CVSS base score of 7.6 the vulnerability is considered high risk. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, exploitation likely requires the attacker to control or observe OCSP traffic, such as by operating a malicious OCSP responder or performing a man\u2011in\u2011the\u2011middle attack. If successful, the attacker can forge responses and cause TLS clients to accept revoked certificates, potentially exposing confidentiality and integrity of the transported data."}}}}, "created": "2026-04-08T19:38:10.664042+00:00", "updated": "2026-04-08T19:49:43.499695+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp", "erlang$PRODUCT$otp"]}