The vulnerability CVE-2026-42790 in Erlang OTP's public_key module involves improper certificate validation that enables a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Specifically, the function pubkey_cert:validate_names/6 only checks DNS entries in the subjectAltName extension against nameConstraints, ignoring the subject CommonName when no subjectAltName is present. According to RFC 5280, a permitted DNS subtree restriction applies only to DNS-typed names in subjectAltName, so a leaf certificate without subjectAltName trivially satisfies any permitted DNS nameConstraints regardless of its CommonName. Additionally, the hostname verification function public_key:pkix_verify_hostname/3 falls back to matching the CommonName if no subjectAltName exists, allowing acceptance of out-of-scope hostnames. This combination allows a subordinate CA restricted by DNS nameConstraints to issue a leaf certificate accepted for hostnames outside the permitted DNS subtree. The vulnerability affects Erlang OTP versions from OTP 19.3 up to but not including OTP 29.0.1, OTP 28.5.0.1, OTP 27.3.4.12, and OTP 26.2.5.21, corresponding to public_key versions from 1.4 before 1.21.1, 1.20.3.1, 1.17.1.3, and 1.15.1.7. The issue is exploitable via the standard ssl:connect function with verify_peer enabled, a trusted CA, SNI, and the strict https hostname matcher. Red Hat has released security updates addressing this issue in their Erlang packages for OpenStack Services on OpenShift 18.0.

This vulnerability allows an attacker controlling a subordinate CA with DNS nameConstraints restrictions to issue a leaf certificate without subjectAltName that is accepted by Erlang OTP TLS clients for hostnames outside the permitted DNS subtree. This leads to hostname spoofing during TLS connections, potentially enabling man-in-the-middle attacks or impersonation of services. The vulnerability affects TLS hostname verification in Erlang OTP, impacting applications relying on Erlang's ssl module for secure communications. The CVSS 4.0 base score is 7.6 (high severity), reflecting network attack vector, high impact on confidentiality and integrity, and partial attack complexity and user interaction requirements.

A patch is available and should be applied to affected Erlang OTP versions. Red Hat has released updated Erlang packages for OpenStack Services on OpenShift 18.0 that address this vulnerability. For cloud services using Erlang OTP, the vendor manages remediation server-side. Users should consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-42790 and apply the recommended updates promptly. No additional mitigation steps are indicated beyond applying the official fixes.