CVE-2026-32144 — Improper Certificate Validation in OTP

CWE-295 — Improper Certificate ValidationCWE-347 — Improper Verification of Cryptographic Signature10 documents8 sources
Severity
7.6HIGHNVD
EPSS
0.0%
top 86.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Erlang OTP
Timeline
PublishedApr 7
Latest updateApr 13

Description

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning ex…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Affected Packages1 packages

▶CVEListV5erlang/otp1.16 — *+3

🔴Vulnerability Details

3
VulDB
Erlang OTP up to 28.4.2 Self-Signed Certificate pubkey_ocsp.erl certificate validation (Nessus ID 305687 / WID-SEC-2026-0998)↗2026-04-13
▶
OSV
CVE-2026-32144: Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via↗2026-04-07
▶
CVEList
OCSP designated-responder authorization bypass via missing signature verification↗2026-04-07
▶

📋Vendor Advisories

2
Red Hat
Erlang OTP: Erlang OTP public_key: OCSP authorization bypass and information disclosure due to missing signature verification↗2026-04-07
▶
Debian
CVE-2026-32144: erlang - Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_o...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-32144 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

3
Bugzilla
CVE-2026-32144 erlang: Erlang OTP public_key: OCSP authorization bypass and information disclosure due to missing signature verification [fedora-all]↗2026-04-07
▶
Bugzilla
CVE-2026-32144 erlang: Erlang OTP public_key: OCSP authorization bypass and information disclosure due to missing signature verification [epel-all]↗2026-04-07
▶
Bugzilla
CVE-2026-32144 Erlang OTP: Erlang OTP public_key: OCSP authorization bypass and information disclosure due to missing signature verification↗2026-04-07
▶
CVE-2026-32144 — Improper Certificate Validation in OTP | cvebase