Erlang OTP EUVD-2026-32273

Exploitation requires that the targeted Erlang/OTP application has OCSP stapling explicitly enabled in the ssl application's TLS client configuration (it is not enabled by default), or that the application calls public_key:pkix_ocsp_validate/5 directly. Beyond the deployment configuration requirement, the attacker must possess the private key of a CA-designated OCSP responder certificate that has already expired-a significant precondition that requires either a prior PKI compromise, access to retired CA infrastructure, or a decommissioned HSM. The attack also requires the attacker to control or compromise the TLS server being contacted by the victim client, so that a forged OCSP staple can be injected into the TLS handshake. Exploitation is not automatable at scale (SSVC: no) due to these prerequisites. What limits exploitation: OCSP stapling is non-default in OTP; possession of an expired responder private key is a rare attacker capability; and the attacker must be positioned as or compromise the TLS server the client contacts. CVSS PR:N confirms no authentication to the target system is required once the above preconditions are met.

The CVSS 4.0 score of 6.3 (Medium) with vector AV:N/AC:H/AT:P/PR:N/UI:N reflects a network-reachable flaw requiring no authentication, but with high attack complexity and the presence of specific deployment prerequisites, both of which significantly limit real-world exploitation. The AT:P (Attack Requirements: Present) metric aligns with the technical requirement that an attacker must control or compromise a TLS server presenting a forged OCSP staple, and the AC:H complexity corresponds to the prerequisite of possessing the private key of an expired OCSP responder certificate-a non-trivial precondition. SSVC independently rates the vulnerability as not automatable with only partial technical impact, consistent with the CVSS assessment. Confidentiality impact is rated none; only integrity and scope-changed system integrity are partially affected, reflecting the nature of the bypass (accepting a revoked cert) rather than direct data exfiltration. No EPSS data was provided in the input, but given SSVC exploitation status of 'none,' CISA KEV absence, and the high attack complexity, the probability of opportunistic mass exploitation is low. The primary realistic risk is in targeted scenarios: a compromised TLS endpoint presenting a revoked certificate to clients that rely on OCSP stapling for revocation checking. Note that only OTP deployments with OCSP stapling enabled or direct use of public_key:pkix_ocsp_validate/5 are exposed; the vast majority of Erlang/OTP deployments that do not use OCSP are unaffected.

An attacker who has compromised or obtained the private key of an expired OCSP responder certificate-for example through a legacy CA archive, a decommissioned HSM, or a prior PKI breach-sets up or controls a TLS server presenting a revoked certificate. The server forges an OCSP response for the revoked certificate signed with the expired responder key and staples it to the TLS handshake. An Erlang/OTP TLS client (on an affected version with OCSP stapling enabled) receives the stapled response, calls verify_response/5, which skips the responder certificate validity-period check, accepts the forged response as valid, and proceeds to trust the revoked server certificate-achieving an authentication bypass or enabling a man-in-the-middle position. No public proof-of-concept exploit code exists at time of analysis.