CVE-2026-42789: erlang/otp from 17.0 (inclusive), before 26.2.5.21 (exclusive), from 27.0 (inclusive), before 27.3.4.12 (exclusive)…

Affected technology

erlang/otp · from 17.0 (inclusive), before 26.2.5.21 (exclusive)
erlang

erlang/otp · from 27.0 (inclusive), before 27.3.4.12 (exclusive)
erlang

erlang/otp · from 28.0 (inclusive), before 28.5.0.1 (exclusive)
erlang

erlang/otp · from 29.0 (inclusive), before 29.0.1 (exclusive)
erlang

OTP · 17.0 to before *; status changes: 27.3.4.19 — unaffected, 28.5.0.8 — unaffected, 29.1.2 — unaffected
Erlang

OTP · 0.22 to before *; status changes: 1.17.1.7 — unaffected, 1.20.3.6 — unaffected, 1.21.8 — unaffected
Erlang

OTP · 84adefa331c4159d432d22840663c38f155cd4c1 to before *; status changes: 0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8 — unaffected, 75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333 — unaffected, 82af606b5437c4de1276dbcc8855a47e88231226 — unaffected
Erlang

Red Hat OpenStack Platform 16.2 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenStack Services on OpenShift 18.0 · Exact affected versions not specified by the source
Red Hat

Red Hat Hardened Images · Exact affected versions not specified by the source
Red Hat

Red Hat OpenStack Platform 17.1 · Exact affected versions not specified by the source
Red Hat

Component: pubkey_cert
Function: pubkey_cert:validate_extensions/7
File: lib/public_key/src/pubkey_cert.erl, src/pubkey_cert.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 7.0/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.