CVE-2026-42789

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement. Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers. This issue affects OTP from OTP 17.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP 17.0, corresponding to public_key before 0.22, is affected is unknown.

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.

In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.

Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP 17.0, corresponding to public_key before 0.22, is affected is unknown.

These are all security issues fixed in the erlang27-27.1.3-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the erlang-28.5.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for erlang fixes the following issues

• CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
• CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42791: OCSP response verification in the public_key application does not check the validity period of the OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).

This update for erlang fixes the following issues

• CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
• CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42791: OCSP response verification in the public_key application does not check the validity period of the OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).

This update for erlang26 fixes the following issues:

• CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42792: permanent epmd DoS via connection slot exhaustion due to improper handling of exceptional conditions (bsc#1272908).
• CVE-2026-47078: relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass (bsc#1272909).
• CVE-2026-48855: SFTP READLINK response leaks absolute backend filesystem path when root is configured (bsc#1268139).
• CVE-2026-48856: httpc leaks Authorization headers to cross-origin redirect targets (bsc#1268141).
• CVE-2026-48858: server-side request forgery allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address (bsc#1268142).
• CVE-2026-48860: ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist (bsc#1268146).
• CVE-2026-49759: unbounded stack buffer overflow in SCTP error cause parsing in inet_drv (bsc#1268163).
• CVE-2026-49760: stack buffer overflow in ei_s_print_term at very large integer (bsc#1268164).
• CVE-2026-53422: SFTP REALPATH path-existence oracle allows filesystem enumeration outside configured root (bsc#1270245).
• CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop (bsc#1270246).
• CVE-2026-54887: use of default cryptographic key allows predictable DTLS cookie computation during the startup window (bsc#1270247).
• CVE-2026-54891: plaintext injection towards (D)TLS client during handshake (bsc#1270250).
• CVE-2026-55737: heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXTP decoding in erts external term format decoder (bsc#1272910).
• CVE-2026-55950: time-of-check time-of-use race condition allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener (bsc#1270253).
• CVE-2026-55952: missing validation allows for DoS of the TLS-1.3 server when clients send a malformed ClientHello with mismatched PSK identity and binder list lengths (bsc#1270258).
• CVE-2026-55953: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server authentication bypass (bsc#1272911).
• CVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (bsc#1272913).
• CVE-2026-59250: megaco flex scanner buffer overflow via oversized property parm name (bsc#1272914).
• CVE-2026-59251: denial of service via exponential certificate policy tree growth in path validation (bsc#1272915).

This update for erlang fixes the following issues:

• CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726).
• CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
• CVE-2026-42790: Name constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
• CVE-2026-42792: permanent epmd DoS via connection slot exhaustion due to improper handling of exceptional conditions (bsc#1272908).
• CVE-2026-47078: relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass (bsc#1272909).
• CVE-2026-48855: SFTP READLINK response leaks absolute backend filesystem path when root is configured (bsc#1268139).
• CVE-2026-48856: httpc leaks Authorization headers to cross-origin redirect targets (bsc#1268141).
• CVE-2026-48858: server-side request forgery allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address (bsc#1268142).
• CVE-2026-49759: unbounded stack buffer overflow in SCTP error cause parsing in inet_drv (bsc#1268163).
• CVE-2026-49760: stack buffer overflow in ei_s_print_term at very large integer (bsc#1268164).
• CVE-2026-53422: SFTP REALPATH path-existence oracle allows filesystem enumeration outside configured root (bsc#1270245).
• CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop (bsc#1270246).
• CVE-2026-54887: use of default cryptographic key allows predictable DTLS cookie computation during the startup window (bsc#1270247).
• CVE-2026-54891: plaintext injection towards (D)TLS client during handshake (bsc#1270250).
• CVE-2026-55737: heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXTP decoding in erts external term format decoder (bsc#1272910).
• CVE-2026-55952: missing validation allows for DoS of the TLS-1.3 server when clients send a malformed ClientHello with mismatched PSK identity and binder list lengths (bsc#1270258).
• CVE-2026-55953: TLS 1.2 and DTLS clients accept unoffered anonymous cipher suites and allow for server authentication bypass (bsc#1272911).
• CVE-2026-58227: TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (bsc#1272913).
• CVE-2026-59250: megaco flex scanner buffer overflow via oversized property parm name (bsc#1272914).

Wander Nauta discovered that Erlang incorrectly handled absolute paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-4748)

It was discovered that the Erlang SFTP server did not properly limit the size of packets. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-26618)

It was discovered that the Erlang SSH server did not properly limit the length of algorithm names in key exchange messages. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2025-30211)

It was discovered that the Erlang TFTP server incorrectly handled certain file paths. A remote attacker could possibly use this issue to access files outside of the intended directory. (CVE-2026-21620)

It was discovered that the Erlang SFTP server incorrectly validated paths against the configured root directory. An authenticated user could possibly use this issue to access files outside of the root directory. (CVE-2026-23942)

It was discovered that the Erlang SSH server enabled zlib compression by default and did not limit the size of decompressed data. A remote attacker could possibly use this issue to cause Erlang to use excessive resources, leading to a denial of service. (CVE-2026-23943)

It was discovered that the Erlang HTTP server incorrectly applied directory access controls to CGI scripts served via script aliases. A remote attacker could possibly use this issue to bypass authentication and access protected CGI scripts. (CVE-2026-28808)

It was discovered that the Erlang DNS resolver used predictable transaction IDs and did not randomize source ports. A remote attacker could possibly use this issue to perform DNS cache poisoning attacks. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-28810)

It was discovered that Erlang did not verify the signatures of designated OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses and bypass certificate revocation checks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32144)

It was discovered that the Erlang SFTP server incorrectly handled file attribute changes on open file handles. An authenticated user could possibly use this issue to modify the attributes of files outside of the root directory. (CVE-2026-32147)

It was discovered that Erlang incorrectly allowed non-CA certificates to act as intermediate certificate issuers. A remote attacker could possibly use this issue to forge certificate chains. (CVE-2026-42789)

It was discovered that Erlang incorrectly handled DNS name constraints during hostname verification. A remote attacker could possibly use this issue to bypass certificate validation. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42790)

It was discovered that Erlang did not check the validity period of OCSP responder certificates. A remote attacker could possibly use this issue to forge OCSP responses using an expired responder certificate. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-42791)

It was discovered that Erlang incorrectly handled relative paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-47078)

It was discovered that the Erlang SFTP server exposed absolute paths when reading symbolic links. An…