The vulnerability CVE-2026-32144 in Erlang OTP's public_key:pkix_ocsp_validate/5 function involves improper certificate validation (CWE-295). Specifically, the function fails to verify that a CA-designated OCSP responder certificate is cryptographically signed by the issuing CA, relying only on issuer name matching and the OCSPSigning EKU. An attacker capable of intercepting or controlling OCSP responses can create a self-signed certificate with a matching issuer name and OCSPSigning EKU to forge OCSP responses. This can cause clients using OCSP stapling to accept revoked certificates as valid, potentially exposing sensitive data to compromised servers. The vulnerability affects OTP versions 27.0 through 28.4.2, public_key versions 1.16 through 1.20.3, and ssl versions 11.2 through 11.5.4. No vendor advisory or patch information is currently available.

The vulnerability allows attackers who can intercept or manipulate OCSP responses to bypass OCSP designated-responder authorization, enabling them to forge OCSP responses that mark revoked certificates as valid. This undermines the trust model of SSL/TLS connections using OCSP stapling, potentially allowing connections to servers with revoked certificates and exposing sensitive data. The impact on applications using the public_key:pkix_ocsp_validate/5 API depends on how the API is used but generally involves acceptance of invalid certificate status information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider mitigating risk by disabling OCSP stapling or avoiding reliance on the vulnerable OCSP validation function where feasible. Monitor Erlang OTP vendor channels for updates and apply patches promptly once available.