RHSA-2026:39809
Vulnerability from csaf_redhat - Published: 2026-07-15 09:55 - Updated: 2026-07-15 12:49Summary
Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update
Severity
Important
Notes
Topic: An update for erlang is now available for Red Hat OpenStack Services on
OpenShift 18.0 (Antelope).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Erlang is a general-purpose programming language and runtime environment.
Erlang has built-in support for concurrency, distribution and fault
tolerance. Erlang is used in several large telecommunication systems from
Ericsson.
Security Fix(es):
* Erlang OTP public_key: Certificate chain forgery via improper trust chain
validation (CVE-2026-42789)
* Erlang OTP public_key: Certificate validation bypass allows hostname
spoofing (CVE-2026-42790)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Erlang OTP's public_key module. This vulnerability (CWE-295), related to improper certificate validation, allows a non-Certificate Authority (CA) certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can exploit this by forging leaf certificates for arbitrary identities. This can lead to compromised server identity verification on the client side and client certificate verification on mutual Transport Layer Security (mTLS) servers, undermining the trust in certificate-based authentication.
8.0 (High)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Erlang OTP public_key. This improper certificate validation vulnerability allows a subordinate Certificate Authority (CA) with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name (SAN) but contains a crafted CommonName (CN), an attacker can trick an Erlang OTP TLS client into accepting it as valid for an out-of-scope hostname. This can lead to hostname spoofing and potential man-in-the-middle attacks, compromising the integrity and confidentiality of communications.
7.4 (High)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
25 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for erlang is now available for Red Hat OpenStack Services on\nOpenShift 18.0 (Antelope).\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Erlang is a general-purpose programming language and runtime environment.\nErlang has built-in support for concurrency, distribution and fault\ntolerance. Erlang is used in several large telecommunication systems from\nEricsson.\n\nSecurity Fix(es):\n\n* Erlang OTP public_key: Certificate chain forgery via improper trust chain\nvalidation (CVE-2026-42789)\n\n* Erlang OTP public_key: Certificate validation bypass allows hostname\nspoofing (CVE-2026-42790)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:39809",
"url": "https://access.redhat.com/errata/RHSA-2026:39809"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2482093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482093"
},
{
"category": "external",
"summary": "2482286",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482286"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39809.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update",
"tracking": {
"current_release_date": "2026-07-15T12:49:04+00:00",
"generator": {
"date": "2026-07-15T12:49:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.2"
}
},
"id": "RHSA-2026:39809",
"initial_release_date": "2026-07-15T09:55:47+00:00",
"revision_history": [
{
"date": "2026-07-15T09:55:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-15T09:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-15T12:49:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenStack Services on OpenShift 18.0",
"product": {
"name": "Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:18.0::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Services on OpenShift"
},
{
"branches": [
{
"category": "product_version",
"name": "erlang-0:26.2.5.21-2.el9ost.src",
"product": {
"name": "erlang-0:26.2.5.21-2.el9ost.src",
"product_id": "erlang-0:26.2.5.21-2.el9ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang@26.2.5.21-2.el9ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-asn1@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-compiler@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-crypto@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-eldap@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-erts@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-inets@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-kernel@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-mnesia@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-os_mon@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-parsetools@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-public_key@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-runtime_tools@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-sasl@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-snmp@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-ssl@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-stdlib@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-syntax_tools@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-tools@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-xmerl@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-debugsource@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-asn1-debuginfo@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-crypto-debuginfo@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-debuginfo@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-erl_interface-debuginfo@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-erts-debuginfo@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-gdb-tools-debuginfo@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-odbc-debuginfo@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-os_mon-debuginfo@26.2.5.21-2.el9ost?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product": {
"name": "erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_id": "erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/erlang-runtime_tools-debuginfo@26.2.5.21-2.el9ost?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-0:26.2.5.21-2.el9ost.src as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src"
},
"product_reference": "erlang-0:26.2.5.21-2.el9ost.src",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-asn1-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-compiler-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-crypto-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-eldap-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-erts-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-inets-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-kernel-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-public_key-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-sasl-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-snmp-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-ssl-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-tools-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64 as a component of Red Hat OpenStack Services on OpenShift 18.0",
"product_id": "9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64"
},
"product_reference": "erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64",
"relates_to_product_reference": "9Base-RHOSO-18.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-42789",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-27T15:10:36.175135+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482093"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Erlang OTP\u0027s public_key module. This vulnerability (CWE-295), related to improper certificate validation, allows a non-Certificate Authority (CA) certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can exploit this by forging leaf certificates for arbitrary identities. This can lead to compromised server identity verification on the client side and client certificate verification on mutual Transport Layer Security (mTLS) servers, undermining the trust in certificate-based authentication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability where Erlang OTP\u0027s `public_key` module improperly validates certificate chains. A remote attacker with an existing end-entity certificate from a trusted Certificate Authority can forge new leaf certificates, leading to compromised server or client identity verification in TLS/mTLS connections. This impacts applications within Red Hat OpenStack Platform and Community Projects that utilize the default verifier in the OTP `ssl` application. Because an attacker must be able to create or locate a certificate with specific attributes, Red Hat assesses the impact of this vulnerability as Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src",
"9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42789"
},
{
"category": "external",
"summary": "RHBZ#2482093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42789",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42789"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42789",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42789"
},
{
"category": "external",
"summary": "https://cna.erlef.org/cves/CVE-2026-42789.html",
"url": "https://cna.erlef.org/cves/CVE-2026-42789.html"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/commit/471cd2f664300a95353c467873800bbe706005db",
"url": "https://github.com/erlang/otp/commit/471cd2f664300a95353c467873800bbe706005db"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/commit/59c8d824386b2eb1614ff9340624843ef6aca0fd",
"url": "https://github.com/erlang/otp/commit/59c8d824386b2eb1614ff9340624843ef6aca0fd"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq",
"url": "https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq"
},
{
"category": "external",
"summary": "https://osv.dev/vulnerability/EEF-CVE-2026-42789",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-42789"
},
{
"category": "external",
"summary": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
}
],
"release_date": "2026-05-27T12:23:06.355000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-15T09:55:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src",
"9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:39809"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src",
"9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src",
"9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation"
},
{
"cve": "CVE-2026-42790",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-27T17:02:53.354271+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482286"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Erlang OTP public_key. This improper certificate validation vulnerability allows a subordinate Certificate Authority (CA) with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name (SAN) but contains a crafted CommonName (CN), an attacker can trick an Erlang OTP TLS client into accepting it as valid for an out-of-scope hostname. This can lead to hostname spoofing and potential man-in-the-middle attacks, compromising the integrity and confidentiality of communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Erlang OTP\u0027s public_key module allows a subordinate Certificate Authority to bypass DNS name constraints during TLS hostname verification. An attacker could exploit this by issuing a specially crafted certificate lacking a Subject Alternative Name but containing a malicious CommonName, enabling hostname spoofing and potential man-in-the-middle attacks against Red Hat products acting as Erlang OTP TLS clients.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src",
"9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42790"
},
{
"category": "external",
"summary": "RHBZ#2482286",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482286"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42790"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42790",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42790"
},
{
"category": "external",
"summary": "https://cna.erlef.org/cves/CVE-2026-42790.html",
"url": "https://cna.erlef.org/cves/CVE-2026-42790.html"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/commit/0769050c69d73762672b0db1347b6993a5b31759",
"url": "https://github.com/erlang/otp/commit/0769050c69d73762672b0db1347b6993a5b31759"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/commit/21abed64eb2026b5f82f432709e4e932f9be389a",
"url": "https://github.com/erlang/otp/commit/21abed64eb2026b5f82f432709e4e932f9be389a"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/commit/fb67c6d1836f51105a96d8b769e71e4215a79457",
"url": "https://github.com/erlang/otp/commit/fb67c6d1836f51105a96d8b769e71e4215a79457"
},
{
"category": "external",
"summary": "https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447",
"url": "https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447"
},
{
"category": "external",
"summary": "https://osv.dev/vulnerability/EEF-CVE-2026-42790",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-42790"
},
{
"category": "external",
"summary": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
}
],
"release_date": "2026-05-27T15:09:01.860000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-15T09:55:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src",
"9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:39809"
},
{
"category": "workaround",
"details": "Ensure all TLS certificates used in the deployment include Subject Alternative Name (SAN) extensions with the appropriate DNS entries. Certificates relying solely on the CommonName (CN) field for hostname identification are susceptible to this bypass. For Erlang applications, the verify_fun option in the ssl module can be configured to reject peer certificates missing the subjectAltName extension.",
"product_ids": [
"9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src",
"9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSO-18.0:erlang-0:26.2.5.21-2.el9ost.src",
"9Base-RHOSO-18.0:erlang-asn1-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-asn1-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-compiler-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-crypto-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-debugsource-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-eldap-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erl_interface-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-erts-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-gdb-tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-inets-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-kernel-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-mnesia-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-odbc-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-os_mon-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-parsetools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-public_key-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-runtime_tools-debuginfo-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-sasl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-snmp-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-ssl-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-stdlib-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-syntax_tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-tools-0:26.2.5.21-2.el9ost.x86_64",
"9Base-RHOSO-18.0:erlang-xmerl-0:26.2.5.21-2.el9ost.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…