CVE-2026-42790

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com): First, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no subjectAltName therefore trivially satisfies any permitted;DNS:... constraint regardless of its subject commonName. Second, public_key:pkix_verify_hostname/3 in lib/public_key/src/public_key.erl falls back to the subject commonName when no subjectAltName is present, extracting id-at-commonName attributes as presented IDs and matching them against the reference hostname. The strict pkix_verify_hostname_match_fun(https) matcher does not suppress this fallback. The result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the nameConstraints are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock ssl:connect with verify_peer, a trusted CA, SNI, and the canonical strict https hostname matcher. This issue affects OTP from OTP 19.3 before OTP 29.0.1, OTP 28.5.0.1, OTP 27.3.4.12 and OTP 26.2.5.21, corresponding to public_key from 1.4 before 1.21.1, 1.20.3.1, 1.17.1.3 and 1.15.1.7.

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification.

Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com):

First, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no subjectAltName therefore trivially satisfies any permitted;DNS:... constraint regardless of its subject commonName.

Second, public_key:pkix_verify_hostname/3 in lib/public_key/src/public_key.erl falls back to the subject commonName when no subjectAltName is present, extracting id-at-commonName attributes as presented IDs and matching them against the reference hostname. The strict pkix_verify_hostname_match_fun(https) matcher does not suppress this fallback.

The result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the nameConstraints are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock ssl:connect with verify_peer, a trusted CA, SNI, and the canonical strict https hostname matcher.

This issue affects OTP from OTP 19.3 before OTP 29.0.1, OTP 28.5.0.1, OTP 27.3.4.12 and OTP 26.2.5.21, corresponding to public_key from 1.4 before 1.21.1, 1.20.3.1, 1.17.1.3 and 1.15.1.7.

These are all security issues fixed in the erlang27-27.1.3-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the erlang-28.5.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for erlang fixes the following issues

• CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
• CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42791: OCSP response verification in the public_key application does not check the validity period of the OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).

This update for erlang fixes the following issues

• CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
• CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42791: OCSP response verification in the public_key application does not check the validity period of the OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).

This update for erlang26 fixes the following issues:

• CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42792: permanent epmd DoS via connection slot exhaustion due to improper handling of exceptional conditions (bsc#1272908).
• CVE-2026-47078: relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass (bsc#1272909).
• CVE-2026-48855: SFTP READLINK response leaks absolute backend filesystem path when root is configured (bsc#1268139).
• CVE-2026-48856: httpc leaks Authorization headers to cross-origin redirect targets (bsc#1268141).
• CVE-2026-48858: server-side request forgery allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address (bsc#1268142).
• CVE-2026-48860: ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist (bsc#1268146).
• CVE-2026-49759: unbounded stack buffer overflow in SCTP error cause parsing in inet_drv (bsc#1268163).
• CVE-2026-49760: stack buffer overflow in ei_s_print_term at very large integer (bsc#1268164).
• CVE-2026-53422: SFTP REALPATH path-existence oracle allows filesystem enumeration outside configured root (bsc#1270245).
• CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop (bsc#1270246).
• CVE-2026-54887: use of default cryptographic key allows predictable DTLS cookie computation during the startup window (bsc#1270247).
• CVE-2026-54891: plaintext injection towards (D)TLS client during handshake (bsc#1270250).
• CVE-2026-55737: heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXTP decoding in erts external term format decoder (bsc#1272910).
• CVE-2026-55950: time-of-check time-of-use race condition allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener (bsc#1270253).
• CVE-2026-55952: missing validation allows for DoS of the TLS-1.3 server when clients send a malformed ClientHello with mismatched PSK identity and binder list lengths (bsc#1270258).
• CVE-2026-55953: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server authentication bypass (bsc#1272911).
• CVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (bsc#1272913).
• CVE-2026-59250: megaco flex scanner buffer overflow via oversized property parm name (bsc#1272914).
• CVE-2026-59251: denial of service via exponential certificate policy tree growth in path validation (bsc#1272915).

This update for erlang fixes the following issues:

• CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42792: permanent epmd DoS via connection slot exhaustion due to improper handling of exceptional conditions (bsc#1272908).
• CVE-2026-47078: relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass (bsc#1272909).
• CVE-2026-48855: SFTP READLINK response leaks absolute backend filesystem path when root is configured (bsc#1268139).
• CVE-2026-48856: httpc leaks Authorization headers to cross-origin redirect targets (bsc#1268141).
• CVE-2026-48858: server-side request forgery allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address (bsc#1268142).
• CVE-2026-49759: unbounded stack buffer overflow in SCTP error cause parsing in inet_drv (bsc#1268163).
• CVE-2026-49760: stack buffer overflow in ei_s_print_term at very large integer (bsc#1268164).
• CVE-2026-53422: SFTP REALPATH path-existence oracle allows filesystem enumeration outside configured root (bsc#1270245).
• CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop (bsc#1270246).
• CVE-2026-54887: use of default cryptographic key allows predictable DTLS cookie computation during the startup window (bsc#1270247).
• CVE-2026-54891: plaintext injection towards (D)TLS client during handshake (bsc#1270250).
• CVE-2026-55737: heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXTP decoding in erts external term format decoder (bsc#1272910).
• CVE-2026-55952: missing validation allows for DoS of the TLS-1.3 server when clients send a malformed ClientHello with mismatched PSK identity and binder list lengths (bsc#1270258).
• CVE-2026-55953: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server authentication bypass (bsc#1272911).
• CVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (bsc#1272913).
• CVE-2026-59250: megaco flex scanner buffer overflow via oversized property parm name (bsc#1272914).

Wander Nauta discovered that Erlang incorrectly handled absolute paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-4748)

It was discovered that the Erlang SFTP server did not properly limit the size of packets. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-26618)

It was discovered that the Erlang SSH server did not properly limit the length of algorithm names in key exchange messages. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-30211)

It was discovered that the Erlang TFTP server incorrectly handled certain file paths. A remote attacker could possibly use this issue to access files outside of the intended directory. (CVE-2026-21620)

It was discovered that the Erlang SFTP server incorrectly validated paths against the configured root directory. An authenticated user could possibly use this issue to access files outside of the root directory. (CVE-2026-23942)

It was discovered that the Erlang SSH server enabled zlib compression by default and did not limit the size of decompressed data. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. (CVE-2026-23943)

It was discovered that the Erlang HTTP server incorrectly applied directory access controls to CGI scripts served via script aliases. A remote attacker could possibly use this issue to bypass authentication and access protected CGI scripts. (CVE-2026-28808)

It was discovered that the Erlang DNS resolver used predictable transaction IDs and did not randomize source ports. A remote attacker could possibly use this issue to perform DNS cache poisoning attacks. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-28810)

It was discovered that Erlang did not verify the signatures of designated OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses and bypass certificate revocation checks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32144)

It was discovered that the Erlang SFTP server incorrectly handled file attribute changes on open file handles. An authenticated user could possibly use this issue to modify the attributes of files outside of the root directory. (CVE-2026-32147)

It was discovered that Erlang incorrectly allowed non-CA certificates to act as intermediate certificate issuers. A remote attacker could possibly use this issue to forge certificate chains. (CVE-2026-42789)

It was discovered that Erlang incorrectly handled DNS name constraints during hostname verification. A remote attacker could possibly use this issue to bypass certificate validation. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42790)

It was discovered that Erlang did not check the validity period of OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses using an expired responder certificate. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-42791)

It was discovered that Erlang incorrectly handled relative paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-47078)

It was discovered that the Erlang SFTP server exposed absolute paths when reading symbolic links. An…