{"affected":[{"defaultStatus":"unaffected","ecosystem":"software-id","packageName":"otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"26.2.5.21","status":"unaffected"},{"at":"27.3.4.12","status":"unaffected"},{"at":"28.5.0.1","status":"unaffected"},{"at":"29.0.1","status":"unaffected"}],"lessThan":"*","status":"affected","version":"19.3","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"otp","packageName":"public_key","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"1.15.1.7","status":"unaffected"},{"at":"1.17.1.3","status":"unaffected"},{"at":"1.20.3.1","status":"unaffected"},{"at":"1.21.1","status":"unaffected"}],"lessThan":"*","status":"affected","version":"1.4","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"erlang/otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"0769050c69d73762672b0db1347b6993a5b31759","status":"unaffected"},{"at":"fb67c6d1836f51105a96d8b769e71e4215a79457","status":"unaffected"},{"at":"21abed64eb2026b5f82f432709e4e932f9be389a","status":"unaffected"}],"lessThan":"*","status":"affected","version":"b0c245e8132bb13171e277b1af59c0cec00c9459","versionType":"git"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"erlang","product":"Red Hat OpenStack Platform 16.2","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:23.3.4.18-2.el8ost","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"erlang","product":"Red Hat OpenStack Services on OpenShift 18.0","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:26.2.5.21-2.el9ost","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"erlang27","product":"Red Hat Hardened Images","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"erlang","product":"Red Hat OpenStack Platform 17.1","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-42790","cwes":["CWE-295","CWE-297"],"description":"Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification.\n\nTwo flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) to issue a leaf certificate that an OTP TLS client accepts as a valid identity for an out-of-scope hostname (e.g. victim.example.com):\n\nFirst, pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl only checks SAN DNS entries against nameConstraints. Per RFC 5280, a permitted DNS subtree only restricts certificates that contain a DNS-typed name. A leaf with no subjectAltName therefore trivially satisfies any permitted;DNS:... constraint regardless of its subject commonName.\n\nSecond, public_key:pkix_verify_hostname/3 in lib/public_key/src/public_key.erl falls back to the subject commonName when no subjectAltName is present, extracting id-at-commonName attributes as presented IDs and matching them against the reference hostname. The strict pkix_verify_hostname_match_fun(https) matcher does not suppress this fallback.\n\nThe result is that path validation accepts a CN-only leaf under a DNS-constrained intermediate (no SAN means the nameConstraints are not triggered), and hostname verification then accepts it via the CN fallback. The bypass is reachable from stock ssl:connect with verify_peer, a trusted CA, SNI, and the canonical strict https hostname matcher.\n\nThis issue affects OTP from OTP 19.3 before OTP 26.2.5.21, OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 1.4 before 1.15.1.7, 1.17.1.3, 1.20.3.1, and 1.21.1.","epss":{"date":"2026-11-10","percentile":0.28369,"score":0.00345},"exploits":[],"kev":null,"metrics":[{"score":7.6,"severity":"high","source":"CNA: EEF","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.4,"severity":"high","source":"ADP: redhat-SADP","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794424436207,"publishedAt":1779894541860,"references":[{"source":"CNA: EEF","tags":["vendor-advisory","related"],"url":"https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447"},{"source":"CNA: EEF","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-42790.html"},{"source":"CNA: EEF","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-42790"},{"source":"CNA: EEF","tags":["x_version-scheme"],"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"source":"CNA: EEF","tags":["related"],"url":"https://github.com/erlang/otp/commit/b0c245e8132bb13171e277b1af59c0cec00c9459"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/0769050c69d73762672b0db1347b6993a5b31759"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/fb67c6d1836f51105a96d8b769e71e4215a79457"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/21abed64eb2026b5f82f432709e4e932f9be389a"},{"source":"ADP: redhat-SADP","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-42790"},{"source":"ADP: redhat-SADP","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482286"},{"source":"ADP: redhat-SADP","tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42790.json"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:54757"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:39809"}],"remediation":[{"kind":"workaround","source":"CNA: EEF","text":"The verify_fun option in the ssl application can be used to ensure that TLS connections fail if the end-entity certificate is missing the subjectAltName extension or has no domain name. Do not use a verify_fun that accepts the name_not_permitted error."},{"kind":"fix","source":"ADP: redhat-SADP","text":"RHSA-2026:54757: Red Hat OpenStack Platform 16.2\n\nRHSA-2026:39809: Red Hat OpenStack Services on OpenShift 18.0"},{"kind":"workaround","source":"ADP: redhat-SADP","text":"Ensure all TLS certificates used in the deployment include Subject Alternative Name (SAN) extensions with the appropriate DNS entries. Certificates relying solely on the CommonName (CN) field for hostname identification are susceptible to this bypass. For Erlang applications, the verify_fun option in the ssl module can be configured to reject peer certificates missing the subjectAltName extension."},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/0769050c69d73762672b0db1347b6993a5b31759"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/fb67c6d1836f51105a96d8b769e71e4215a79457"},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/21abed64eb2026b5f82f432709e4e932f9be389a"}],"revision":"b2147da9a6348c5afbea8bc8434a0b8a494d0f6e81679a3ca9ff7d212cbf1120","sources":[{"modifiedAt":1794424436207,"name":"CNA: EEF","retrievedAt":1794427759080,"url":"https://www.cve.org/CVERecord?id=CVE-2026-42790"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794427765519,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42790"}],"ssvc":{"assessedAt":1779840000000,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification","updatedAt":1794427765519}