CVE-2026-32144

🗓️ 07 Apr 2026 12:28:00Reported by EEFType

cve🔗 web.nvd.nist.gov👁 60 Views🌐 WEB

CVE-2026-32144: Erlang OTP pubkey_ocsp bypasses signature check, enabling forged designated-responder OCSP responses.

Reporter	Title	Published	Views	Family All 26
ATTACKERKB	CVE-2026-32144	7 Apr 202612:28	–	attackerkb
Circl	CVE-2026-32144	7 Apr 202615:21	–	circl
CNNVD	Erlang/OTP 安全漏洞	7 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-32144 OCSP designated-responder authorization bypass via missing signature verification	7 Apr 202612:28	–	cvelist
Debian CVE	CVE-2026-32144	7 Apr 202612:28	–	debiancve
Tenable Nessus	Erlang/OTP 27.x < 27.3.4.10 / 28.x < 28.4.2 OCSP Certificate Validation Bypass (CVE-2026-32144)	9 Apr 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : erlang (openSUSE-SU-2026:20607-1)	24 Apr 202600:00	–	nessus
Tenable Nessus	Photon OS 4.0: Erlang PHSA-2026-4.0-1005	6 May 202600:00	–	nessus
Tenable Nessus	Photon OS 5.0: Erlang PHSA-2026-5.0-0831	6 May 202600:00	–	nessus
Tenable Nessus	Photon OS 5.0: Erlang PHSA-2026-5.0-91-0831	5 Aug 202600:00	–	nessus

NVD

CNA

Node

erlang erlang/otpRange27.0–27.3.4.10

erlang erlang/otpRange28.0–28.4.2

erlang erlang/public_keyRange1.16–1.17.1.2

erlang erlang/public_keyRange1.18–1.20.3

erlang erlang/sslRange11.2–11.2.12.7

erlang erlang/sslRange11.3–11.5.4

[
  {
    "cpes": [
      "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unknown",
    "modules": [
      "pubkey_ocsp"
    ],
    "packageName": "public_key",
    "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
    "product": "OTP",
    "programFiles": [
      "src/pubkey_ocsp.erl"
    ],
    "programRoutines": [
      {
        "name": "pubkey_ocsp:is_authorized_responder/3"
      }
    ],
    "repo": "https://github.com/erlang/otp",
    "vendor": "Erlang",
    "versions": [
      {
        "changes": [
          {
            "at": "1.20.3",
            "status": "unaffected"
          },
          {
            "at": "1.17.1.2",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "1.16",
        "versionType": "otp"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unknown",
    "modules": [
      "ssl_stapling"
    ],
    "packageName": "ssl",
    "packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
    "product": "OTP",
    "programFiles": [
      "src/ssl_stapling.erl"
    ],
    "repo": "https://github.com/erlang/otp",
    "vendor": "Erlang",
    "versions": [
      {
        "changes": [
          {
            "at": "11.5.4",
            "status": "unaffected"
          },
          {
            "at": "11.2.12.7",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "11.2",
        "versionType": "otp"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unknown",
    "modules": [
      "pubkey_ocsp"
    ],
    "packageName": "erlang/otp",
    "packageURL": "pkg:github/erlang/otp",
    "product": "OTP",
    "programFiles": [
      "lib/public_key/src/pubkey_ocsp.erl"
    ],
    "programRoutines": [
      {
        "name": "pubkey_ocsp:is_authorized_responder/3"
      }
    ],
    "repo": "https://github.com/erlang/otp",
    "vendor": "Erlang",
    "versions": [
      {
        "changes": [
          {
            "at": "28.4.2",
            "status": "unaffected"
          },
          {
            "at": "27.3.4.10",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "27.0",
        "versionType": "otp"
      },
      {
        "changes": [
          {
            "at": "ac7ff528be857c5d35eb29c7f24106e3a16d4891",
            "status": "unaffected"
          },
          {
            "at": "49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0",
            "status": "unaffected"
          }
        ],
        "lessThan": "*",
        "status": "affected",
        "version": "601a012837ea0a5c8095bf24223132824177124d",
        "versionType": "git"
      }
    ]
  }
]

Source	Link
github	www.github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm
github	www.github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0
erlang	www.erlang.org/doc/system/versions.html
osv	www.osv.dev/vulnerability/EEF-CVE-2026-32144
github	www.github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891
cna	www.cna.erlef.org/cves/CVE-2026-32144.html
access	www.access.redhat.com/security/cve/CVE-2026-32144
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32144.json
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

Parameter	Position	Path	Description	CWE
OCSP response	path	lib/public_key/src/pubkey_ocsp.erl	OCSP responder validation flaw allows forging OCSP responses by bypassing proper signature verification when a CA-designated responder certificate is not cryptographically signed by the issuing CA.	CWE-347, CWE-295
responder certificate	path	lib/public_key/src/pubkey_ocsp.erl	OCSP responder validation flaw allows forging OCSP responses by bypassing proper signature verification when a CA-designated responder certificate is not cryptographically signed by the issuing CA.	CWE-347, CWE-295
OCSP signing EKU (OCSPSigning)	path	lib/public_key/src/pubkey_ocsp.erl	OCSP responder validation flaw allows forging OCSP responses by bypassing proper signature verification when a CA-designated responder certificate is not cryptographically signed by the issuing CA.	CWE-347, CWE-295

24 Jul 2026 15:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.4

CVSS 47.6

EPSS0.002

SSVC