Every CVE Search/ Get API key

CVE-2026-42791

OCSP responder certificate validity period not checked in public_key

6.3 MediumFix available

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.

OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.

This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.

This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.32%Up 0.3 points since May 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

OCSP responder certificate validity period not checked in public_key

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.

OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.

This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.

This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.

Record
CVE-2026-42791
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-295, CWE-672
Updated
2026-11-02
EUVDEUVD-2026-32273 6.3

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.

OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.

This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.

This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.

Record
EUVD-2026-32273
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
NVD 6.3

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.

OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.

This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.

This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.

Record
CVE-2026-42791
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-295, CWE-672
Updated
2026-11-02
OSV 6.3

OCSP responder certificate validity period not checked in public_key

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.

OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.

This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.

This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.

Record
CVE-2026-42791
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-295, CWE-672
Updated
2026-11-02
OSVDEBIAN-CVE-2026-42791 3.7

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid. This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate. This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.

Record
DEBIAN-CVE-2026-42791
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVEEF-CVE-2026-42791 6.3

OCSP responder certificate validity period not checked in public_key

Summary

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid.

OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid.

This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate.

This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.

Workarounds

* For TLS clients using the ssl application, disable OCSP stapling by setting {stapling, no_staple} in the client options, or switch to CRL-based revocation checking with {crl_check, true}. * For applications calling public_key:pkix_ocsp_validate/5 directly, validate the responder certificate's validity period in application code before calling the function.

Configurations

For the ssl application, OCSP stapling must be enabled by setting the stapling option to staple in the TLS client options. OCSP stapling is not enabled by default.

Applications calling public_key:pkix_ocsp_validate/5 directly are unconditionally affected when that function is used.

Record
EEF-CVE-2026-42791
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-295, CWE-672
Updated
2026-11-02
Show 7 moreShow less
OSVRHSA-2026:63160 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:63160
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42791 6.3

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 in lib/public_key/src/pubkey_ocsp.erl does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA-designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid. This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where the impact depends on the use case — server-side client certificate validation using this API may allow authentication bypass with a revoked client certificate. This issue affects OTP from OTP 27.0 before OTP 29.0.1, OTP 28.5.0.1 and OTP 27.3.4.12, corresponding to public_key from 1.16 before 1.21.1, 1.20.3.1 and 1.17.1.3.

Record
UBUNTU-CVE-2026-42791
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:10947-1 No score

erlang27-27.1.3-2.1 on GA media

These are all security issues fixed in the erlang27-27.1.3-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10947-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11559-1 No score

erlang-28.5.0.4-1.1 on GA media

These are all security issues fixed in the erlang-28.5.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11559-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20907-1 No score

Security update for erlang

This update for erlang fixes the following issues

  • CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
  • CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).
  • CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
  • CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
  • CVE-2026-42791: OCSP response verification in the public_key application does not check the validity period of the OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).
Record
openSUSE-SU-2026:20907-1
Updated
2026-11-02
OSVSUSE-SU-2026:22082-1 No score

Security update for erlang

This update for erlang fixes the following issues

  • CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
  • CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).
  • CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
  • CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
  • CVE-2026-42791: OCSP response verification in the public_key application does not check the validity period of the OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).
Record
SUSE-SU-2026:22082-1
Updated
2026-11-02
OSVUSN-8901-1 No score

erlang vulnerabilities

Wander Nauta discovered that Erlang incorrectly handled absolute paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-4748)

It was discovered that the Erlang SFTP server did not properly limit the size of packets. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-26618)

It was discovered that the Erlang SSH server did not properly limit the length of algorithm names in key exchange messages. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-30211)

It was discovered that the Erlang TFTP server incorrectly handled certain file paths. A remote attacker could possibly use this issue to access files outside of the intended directory. (CVE-2026-21620)

It was discovered that the Erlang SFTP server incorrectly validated paths against the configured root directory. An authenticated user could possibly use this issue to access files outside of the root directory. (CVE-2026-23942)

It was discovered that the Erlang SSH server enabled zlib compression by default and did not limit the size of decompressed data. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. (CVE-2026-23943)

It was discovered that the Erlang HTTP server incorrectly applied directory access controls to CGI scripts served via script aliases. A remote attacker could possibly use this issue to bypass authentication and access protected CGI scripts. (CVE-2026-28808)

It was discovered that the Erlang DNS resolver used predictable transaction IDs and did not randomize source ports. A remote attacker could possibly use this issue to perform DNS cache poisoning attacks. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-28810)

It was discovered that Erlang did not verify the signatures of designated OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses and bypass certificate revocation checks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32144)

It was discovered that the Erlang SFTP server incorrectly handled file attribute changes on open file handles. An authenticated user could possibly use this issue to modify the attributes of files outside of the root directory. (CVE-2026-32147)

It was discovered that Erlang incorrectly allowed non-CA certificates to act as intermediate certificate issuers. A remote attacker could possibly use this issue to forge certificate chains. (CVE-2026-42789)

It was discovered that Erlang incorrectly handled DNS name constraints during hostname verification. A remote attacker could possibly use this issue to bypass certificate validation. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42790)

It was discovered that Erlang did not check the validity period of OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses using an expired responder certificate. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-42791)

It was discovered that Erlang incorrectly handled relative paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-47078)

It was discovered that the Erlang SFTP server exposed absolute paths when reading symbolic links. An…

Record
USN-8901-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
erlang
Debian:13
 before 1:27.3.4.1+dfsg-1+deb13u3, plus listed versions
1:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1+deb13u11:27.3.4.1+dfsg-1+deb13u2
1:27.3.4.1+dfsg-1+deb13u3
erlang
Debian:14
 before 1:27.3.4.12+dfsg-1, plus listed versions
1:27.3.4.1+dfsg-11:27.3.4.10+dfsg-11:27.3.4.11+dfsg-11:27.3.4.11+dfsg-21:27.3.4.11+dfsg-3
Show 9 moreShow less
1:27.3.4.11+dfsg-41:27.3.4.11+dfsg-51:27.3.4.11+dfsg-61:27.3.4.11+dfsg-71:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.8+dfsg-11:27.3.4.9+dfsg-1
1:27.3.4.12+dfsg-1
erlang27
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-asn1
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-common_test
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-compiler
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-crypto
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-debugger
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-dialyzer
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-diameter
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
Show 45 moreShow less
Affected packages
PackageAffectedFixed
erlang27-edoc
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-eldap
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-erl_interface
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-erts
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-et
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-eunit
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-examples
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-ftp
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-gdb-tools
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-inets
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-jinterface
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-kernel
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-megaco
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-mnesia
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-observer
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-odbc
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-os_mon
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-parsetools
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-public_key
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-reltool
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-runtime_tools
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-sasl
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-snmp
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-ssh
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-ssl
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-stdlib
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-syntax_tools
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-tftp
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-tools
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-wx
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang27-xmerl
Red Hat:hummingbird:1
From an advisory covering 12 CVEs
 before 0:27.3.4.17-1.hum1
0:27.3.4.17-1.hum1
erlang
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 27.1.3-160000.5.1
27.1.3-160000.5.1
erlang
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 27.1.3-160000.5.1
27.1.3-160000.5.1
erlang
Ubuntu:25.10
 All versions, plus listed versions
1:27.3+dfsg-1ubuntu11:27.3+dfsg-1ubuntu1.11:27.3.4.1+dfsg-11:27.3.4.1+dfsg-1build11:27.3.4.1+dfsg-1ubuntu0.1
 None known
erlang
Ubuntu:26.04:LTS
 before 1:27.3.4.6+dfsg-1ubuntu0.2, plus listed versions
1:27.3.4.1+dfsg-1build11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.6+dfsg-1ubuntu0.1
1:27.3.4.6+dfsg-1ubuntu0.2
erlang
Ubuntu:Pro:14.04:LTS
From an advisory covering 30 CVEs
 before 1:16.b.3-dfsg-1ubuntu2.2+esm3, plus listed versions
1:16.b.1-dfsg-4ubuntu11:16.b.2-dfsg-1ubuntu11:16.b.2-dfsg-2ubuntu11:16.b.3-dfsg-1ubuntu11:16.b.3-dfsg-1ubuntu2
Show 4 moreShow less
1:16.b.3-dfsg-1ubuntu2.11:16.b.3-dfsg-1ubuntu2.21:16.b.3-dfsg-1ubuntu2.2+esm11:16.b.3-dfsg-1ubuntu2.2+esm2
1:16.b.3-dfsg-1ubuntu2.2+esm3
erlang
Ubuntu:Pro:16.04:LTS
From an advisory covering 30 CVEs
 before 1:18.3-dfsg-1ubuntu3.1+esm4, plus listed versions
1:18.0-dfsg-1ubuntu11:18.0-dfsg-1ubuntu21:18.2-dfsg-2ubuntu11:18.3-dfsg-1ubuntu11:18.3-dfsg-1ubuntu2
Show 5 moreShow less
1:18.3-dfsg-1ubuntu31:18.3-dfsg-1ubuntu3.11:18.3-dfsg-1ubuntu3.1+esm11:18.3-dfsg-1ubuntu3.1+esm21:18.3-dfsg-1ubuntu3.1+esm3
1:18.3-dfsg-1ubuntu3.1+esm4
erlang
Ubuntu:Pro:18.04:LTS
From an advisory covering 30 CVEs
 before 1:20.2.2+dfsg-1ubuntu2+esm4, plus listed versions
1:20.0.4+dfsg-1ubuntu11:20.1.2+dfsg-1ubuntu11:20.1.3+dfsg-1ubuntu11:20.1.4+dfsg-1ubuntu11:20.1.5+dfsg-1ubuntu1
Show 8 moreShow less
1:20.1.6+dfsg-1ubuntu11:20.1.7+dfsg-1ubuntu11:20.2.1+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu11:20.2.2+dfsg-1ubuntu21:20.2.2+dfsg-1ubuntu2+esm11:20.2.2+dfsg-1ubuntu2+esm21:20.2.2+dfsg-1ubuntu2+esm3
1:20.2.2+dfsg-1ubuntu2+esm4
erlang
Ubuntu:Pro:20.04:LTS
From an advisory covering 30 CVEs
 before 1:22.2.7+dfsg-1ubuntu0.5+esm3, plus listed versions
1:22.0.7+dfsg-1build11:22.2+dfsg-11:22.2.1+dfsg-11:22.2.2+dfsg-11:22.2.3+dfsg-1
Show 9 moreShow less
1:22.2.3+dfsg-21:22.2.4+dfsg-11:22.2.7+dfsg-11:22.2.7+dfsg-1ubuntu0.21:22.2.7+dfsg-1ubuntu0.31:22.2.7+dfsg-1ubuntu0.41:22.2.7+dfsg-1ubuntu0.51:22.2.7+dfsg-1ubuntu0.5+esm11:22.2.7+dfsg-1ubuntu0.5+esm2
1:22.2.7+dfsg-1ubuntu0.5+esm3
erlang
Ubuntu:22.04:LTS
From an advisory covering 30 CVEs
 before 1:24.2.1+dfsg-1ubuntu0.8, plus listed versions
1:23.2.6+dfsg-1build11:24.1.1+dfsg-11:24.1.4+dfsg-11:24.1.5+dfsg-11:24.1.5+dfsg-1ubuntu1
Show 9 moreShow less
1:24.2+dfsg-11:24.2.1+dfsg-11:24.2.1+dfsg-1ubuntu0.11:24.2.1+dfsg-1ubuntu0.21:24.2.1+dfsg-1ubuntu0.31:24.2.1+dfsg-1ubuntu0.41:24.2.1+dfsg-1ubuntu0.51:24.2.1+dfsg-1ubuntu0.61:24.2.1+dfsg-1ubuntu0.7
1:24.2.1+dfsg-1ubuntu0.8
erlang
Ubuntu:24.04:LTS
From an advisory covering 30 CVEs
 before 1:25.3.2.8+dfsg-1ubuntu4.8, plus listed versions
1:25.2.3+dfsg-11:25.3.2.8+dfsg-11:25.3.2.8+dfsg-1ubuntu11:25.3.2.8+dfsg-1ubuntu31:25.3.2.8+dfsg-1ubuntu4
Show 7 moreShow less
1:25.3.2.8+dfsg-1ubuntu4.11:25.3.2.8+dfsg-1ubuntu4.21:25.3.2.8+dfsg-1ubuntu4.31:25.3.2.8+dfsg-1ubuntu4.41:25.3.2.8+dfsg-1ubuntu4.51:25.3.2.8+dfsg-1ubuntu4.61:25.3.2.8+dfsg-1ubuntu4.7
1:25.3.2.8+dfsg-1ubuntu4.8
erlang
Ubuntu:26.04:LTS
From an advisory covering 30 CVEs
 before 1:27.3.4.6+dfsg-1ubuntu0.2, plus listed versions
1:27.3.4.1+dfsg-1build11:27.3.4.3+dfsg-11:27.3.4.4+dfsg-11:27.3.4.6+dfsg-11:27.3.4.6+dfsg-1ubuntu0.1
1:27.3.4.6+dfsg-1ubuntu0.2
erlang27
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 27.1.3-2.1
27.1.3-2.1
erlang
openSUSE:Tumbleweed
From an advisory covering 24 CVEs
 before 28.5.0.4-1.1
28.5.0.4-1.1
erlang
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 27.1.3-160000.5.1
27.1.3-160000.5.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42791 is a medium vulnerability (CVSS 6.3) in Erlang Otp, published May 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in erlang 1:27.3.4.1+dfsg-1+deb13u3.

References

Show 178 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open