nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• erlang erlang/otp19.3 and later · before 26.2.5.21
• erlang erlang/otp27.0 and later · before 27.3.4.12
• erlang erlang/otp28.0 and later · before 28.5.0.1
• erlang erlang/otp29.0 and later · before 29.0.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (EEF). Independent of NVD's CPE analysis and usually ahead of it.

• Erlang OTP

  • 1.4 and lateraffected · otpfixed in 1.15.1.7, 1.17.1.3, 1.20.3.1, 1.21.1
  • 19.3 and lateraffected · otpfixed in 26.2.5.21, 27.3.4.12, 28.5.0.1, 29.0.1
  • b0c245e8132bb13171e277b1af59c0cec00c9459 and lateraffected · gitfixed in 0769050c69d73762672b0db1347b6993a5b31759, fb67c6d1836f51105a96d8b769e71e4215a79457, 21abed64eb2026b5f82f432709e4e932f9be389a

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2025-32433Erlang/OTP SSH Vulnerable to Pre-Authentication RCEKEV
  100Now
• CVE-2022-37026In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-cert
  39Monitor
• CVE-2016-10253An issue was discovered in Erlang/OTP 18.x.
  39Monitor
• CVE-2026-55953TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
  36Monitor
• CVE-2026-49759Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
  35Monitor
• CVE-2026-59251Denial of service via exponential certificate policy tree growth in path validation
  34Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.