CVE-2026-32144

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verification. The OCSP response validation in public_key:pkix_ocsp_validate/5 does not verify that a CA-designated responder certificate was cryptographically signed by the issuing CA. Instead, it only checks that the responder certificate's issuer name matches the CA's subject name and that the certificate has the OCSPSigning extended key usage. An attacker who can intercept or control OCSP responses can create a self-signed certificate with a matching issuer name and the OCSPSigning EKU, and use it to forge OCSP responses that mark revoked certificates as valid. This affects SSL/TLS clients using OCSP stapling, which may accept connections to servers with revoked certificates, potentially transmitting sensitive data to compromised servers. Applications using the public_key:pkix_ocsp_validate/5 API directly are also affected, with impact depending on usage context. This vulnerability is associated with program files lib/public_key/src/pubkey_ocsp.erl and program routines pubkey_ocsp:is_authorized_responder/3. This issue affects OTP from OTP 27.0 before OTP 28.4.2 and OTP 27.3.4.10, corresponding to public_key from 1.16 before 1.20.3 and 1.17.1.2, and ssl from 11.2 before 11.5.4 and 11.2.12.7.

• CWE-295
• CWE-347

• https://cna.erlef.org/cves/CVE-2026-32144.htmlMitigation, Vendor Advisory
• https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0Patch
• https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891Patch
• https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xmMitigation, Third Party Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-32144Third Party Advisory
• https://www.erlang.org/doc/system/versions.html#order-of-versionsVendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-32144
• https://bugzilla.redhat.com/show_bug.cgi?id=2455896
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32144.json

Published

Apr 7, 2026

Last Modified

Jul 24, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32139Dataease is an open source data visualization analysis tool.…5.4
• CVE-2026-3214Authentication Bypass Using an Alternate Path or Channel vul…6.5
• CVE-2026-32140Dataease is an open source data visualization analysis tool.…8.8
• CVE-2026-32141flatted is a circular JSON parser. Prior to 3.4.0, flatted's…7.5
• CVE-2026-32142Shopware is an open commerce platform. /api/_info/config rou…5.3
• CVE-2026-32143Discourse is an open-source discussion platform. From versio…6.5
• CVE-2026-32145Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-32146Improper path validation vulnerability in the Gleam compiler…7.8
• CVE-2026-32147Improper Limitation of a Pathname to a Restricted Directory …4.3
• CVE-2026-32148Insufficient Verification of Data Authenticity vulnerability…5.9
• CVE-2026-32149Improper input validation in Windows Hyper-V allows an autho…7.3
• CVE-2026-3215Improper Neutralization of Input During Web Page Generation …5.4