Vulnerability in Erlang Otp
CVE-2026-32144
Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in public_key:pkix_ocsp_val…
Vulnerability class: Improper Certificate Validation
EPSS: 0.000 (11.9th percentile) — read the EPSS interpretation.
Affected products
- Erlang Otp — versions 1.16, 11.2, 27.0
Weakness classification (CWE)
References
- github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm (vendor-advisory, related)
- cna.erlef.org/cves/CVE-2026-32144.html (related)
- osv.dev/vulnerability/EEF-CVE-2026-32144 (related)
- www.erlang.org/doc/system/versions.html (x_version-scheme)
- github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891 (patch)
- github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0 (patch)