Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4qr6-9z6u-ekb3
Vulnerability ID VCID-4qr6-9z6u-ekb3
Aliases CVE-2026-32144
Summary Erlang OTP: Erlang OTP public_key: OCSP authorization bypass and information disclosure due to missing signature verification
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-347 Improper Verification of Cryptographic Signature
CWE-295 Improper Certificate Validation
System Score Found at
cvssv3 7.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32144.json
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2026-32144
cvssv4 7.6 https://cna.erlef.org/cves/CVE-2026-32144.html
ssvc Track https://cna.erlef.org/cves/CVE-2026-32144.html
cvssv3.1 8.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv4 7.6 https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0
ssvc Track https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0
cvssv4 7.6 https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891
ssvc Track https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891
cvssv4 7.6 https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm
ssvc Track https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm
cvssv4 7.6 https://osv.dev/vulnerability/EEF-CVE-2026-32144
ssvc Track https://osv.dev/vulnerability/EEF-CVE-2026-32144
cvssv4 7.6 https://www.erlang.org/doc/system/versions.html#order-of-versions
ssvc Track https://www.erlang.org/doc/system/versions.html#order-of-versions
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32144.json
https://api.first.org/data/v1/epss?cve=CVE-2026-32144
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2455896 https://bugzilla.redhat.com/show_bug.cgi?id=2455896
49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0 https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0
ac7ff528be857c5d35eb29c7f24106e3a16d4891 https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
CVE-2026-32144.html https://cna.erlef.org/cves/CVE-2026-32144.html
EEF-CVE-2026-32144 https://osv.dev/vulnerability/EEF-CVE-2026-32144
GHSA-gxrm-pf64-99xm https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm
versions.html#order-of-versions https://www.erlang.org/doc/system/versions.html#order-of-versions
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32144.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N Found at https://cna.erlef.org/cves/CVE-2026-32144.html
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-07T13:15:14Z/ Found at https://cna.erlef.org/cves/CVE-2026-32144.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N Found at https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-07T13:15:14Z/ Found at https://github.com/erlang/otp/commit/49033a6d93a5be0ee0dce04e1fb8b4ae7de1e0c0
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N Found at https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-07T13:15:14Z/ Found at https://github.com/erlang/otp/commit/ac7ff528be857c5d35eb29c7f24106e3a16d4891
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N Found at https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-07T13:15:14Z/ Found at https://github.com/erlang/otp/security/advisories/GHSA-gxrm-pf64-99xm
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N Found at https://osv.dev/vulnerability/EEF-CVE-2026-32144
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-07T13:15:14Z/ Found at https://osv.dev/vulnerability/EEF-CVE-2026-32144
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N Found at https://www.erlang.org/doc/system/versions.html#order-of-versions
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-07T13:15:14Z/ Found at https://www.erlang.org/doc/system/versions.html#order-of-versions
Exploit Prediction Scoring System (EPSS)
Percentile 0.12022
EPSS Score 0.00039
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:41:19.664754+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-32144.json 38.6.0