Astra Linux – vulnerability in Erlang

An improper certificate validation vulnerability in Erlang’s OTP publickey pubkeycert and publickey modules enables DNS nameConstraints bypass by allowing a subject CommonName fallback during TLS hostname verification. Two flaws combined allow a subordinate CA whose DNS nameConstraints are...

FreeBSD : Erlang/OTP -- multiple vulnerabilities in ssl, inets, public_key and snmp (3749073b-c8f9-11f1-9ceb-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3749073b-c8f9-11f1-9ceb-4c526214c986 advisory. The Erlang/OTP project reports: OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix the following issues,...

Erlang/OTP -- multiple vulnerabilities in ssl, inets, public_key and snmp

The Erlang/OTP project reports: OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix the following issues, three of which complete earlier incomplete fixes: CVE-2026-105236: DTLS-1.2 session resumption could cross SNI virtual-host boundaries. An SNI-aware server resumed a cached session even when the resumptio...

Security Bulletin:Improper Certificate Validation in Erlang OTP public_key: DNS NameConstraints Bypass in TLS Hostname Verification

Summary Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeycert and publickey modules allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted e.g...

erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...

erlang: Erlang OTP: Authentication bypass due to improper OCSP certificate validation

A flaw was found in Erlang OTP's publickey application, specifically in the Online Certificate Status Protocol OCSP response verification. A remote attacker who has obtained the private key of an expired Certificate Authority CA-designated OCSP responder certificate can forge OCSP responses. This...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...

CVE-2026-18616

GL-iNet GL-MT3000 devices (≤ v4.4.5) are affected by a command injection in the wg-server.so Native Plugin, specifically the server.set_peer function in /cgi-bin/glc. The vulnerability stems from improper handling of the public_key argument, enabling remote code execution. Exploitation is possibl...

CVE-2026-18616

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

CVE-2026-18616: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

AZL-94202 CVE-2026-59251 affecting package erlang for versions less than 26.2.5.21-4

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...

CVE-2026-59251

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...

CVE-2026-59251

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...

CVE-2026-59251

Summary: CVE-2026-59251 is a denial-of-service in Erlang/OTP public_key certificate path validation caused by unbounded growth of the certificate policy tree during RFC 5280 policy processing. The vulnerability occurs when validating TLS certificates; a chain with many policies per certificate ca...

CVE-2026-59251: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...

Security update for erlang

This update for erlang fixes the following issues CVE-2025-4748: improper limitation of a pathname may lead to path traversal bsc1244642. CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in SFTP chroot bsc1262503. CVE-2026-42789: publickey application...

AZL-89175 CVE-2026-42790 affecting package erlang for versions less than 26.2.5.21-1

Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeycert and publickey modules allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted e.g...

CVE-2026-42790

Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeycert and publickey modules allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted e.g...