CVE-2026-32144: OCSP Authorization Bypass in Erlang OTP

The core of this vulnerability lies in the failure to verify that OCSP responder certificates are cryptographically signed by the issuing Certificate Authority (CA). Instead, the validation process only checks issuer and subject name matching and the presence of the OCSPSigning extended key usage. An attacker can leverage this weakness to craft malicious, self-signed OCSP responses that appear valid to the Erlang OTP implementation. This enables a man-in-the-middle (MITM) attack where the attacker can intercept and manipulate TLS/SSL connections, potentially decrypting sensitive data or injecting malicious content. The blast radius extends to any application relying on Erlang OTP for certificate validation, particularly those handling sensitive data or performing critical operations. This is similar in concept to vulnerabilities where OCSP validation is bypassed, allowing for the acceptance of untrusted certificates.

1. Reserved2026-03-10
2. Published2026-04-07
3. EPSS updated2026-04-15

The primary mitigation is to upgrade to a patched version of Erlang OTP as soon as it becomes available. Until a patch is applied, consider implementing OCSP stapling on your servers. OCSP stapling allows the server to present a valid OCSP response directly to the client, eliminating the need for the client to contact the OCSP responder and reducing the attack surface. Additionally, review your application's certificate validation logic to ensure it is robust and doesn't solely rely on OCSP validation. Consider implementing additional validation checks, such as certificate revocation lists (CRLs), to provide a layered defense. Monitor system logs for unusual OCSP-related activity.