THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-42790 (HIGH 8.1) — Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are

[NVD] CVE-2026-42790 (HIGH 8.1) — Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are

lownvdPublished 2026-05-27

CVE-2026-42790 CVSS: 8.1 HIGH Published: 2026-05-27T17:16:36.030

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification.

Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.example.com) t

Indicators of compromise

CVE-2026-42790cve
28.5.0.1ipv4
27.3.4.12ipv4
26.2.5.21ipv4
1.20.3.1ipv4
1.17.1.3ipv4
1.15.1.7ipv4

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-42790