Skip to content
OpenAdvisories
High RHSA-2026:39809 2 CVEs

Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (erlang) security update

Published Jul 16, 2026 · Updated Sep 22, 2026

Ecosystem: Red Hat

Fixed packages 30

ReleasePackageFixed in
Red Hat · OpenStack 18 openstack:18.0::el9 erlang 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-asn1 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-asn1-debuginfo 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-compiler 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-crypto 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-crypto-debuginfo 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-debuginfo 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-debugsource 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-eldap 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-erl_interface-debuginfo 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-erts 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-erts-debuginfo 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-gdb-tools-debuginfo 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-inets 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-kernel 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-mnesia 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-odbc-debuginfo 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-os_mon 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-os_mon-debuginfo 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-parsetools 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-public_key 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-runtime_tools 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-runtime_tools-debuginfo 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-sasl 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-snmp 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-ssl 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-stdlib 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-syntax_tools 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-tools 0:26.2.5.21-2.el9ost
Red Hat · OpenStack 18 openstack:18.0::el9 erlang-xmerl 0:26.2.5.21-2.el9ost

Vulnerabilities 2

  • High 7.6
    CVE-2026-42790

    nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

    Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-42789

    Non-CA certificate accepted as intermediate issuer in public_key path validation

    Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, p…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482093
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482286
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39809.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-42789
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42789
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42789
  • article
    https://cna.erlef.org/cves/CVE-2026-42789.html
  • article
    https://github.com/erlang/otp/commit/471cd2f664300a95353c467873800bbe706005db
  • article
    https://github.com/erlang/otp/commit/59c8d824386b2eb1614ff9340624843ef6aca0fd
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-42789
  • article
    https://www.erlang.org/doc/system/versions.html#order-of-versions
  • report
    https://access.redhat.com/security/cve/CVE-2026-42790
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42790
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42790
  • article
    https://cna.erlef.org/cves/CVE-2026-42790.html
  • article
    https://github.com/erlang/otp/commit/0769050c69d73762672b0db1347b6993a5b31759
  • article
    https://github.com/erlang/otp/commit/21abed64eb2026b5f82f432709e4e932f9be389a
  • article
    https://github.com/erlang/otp/commit/fb67c6d1836f51105a96d8b769e71e4215a79457
  • article
    https://github.com/erlang/otp/security/advisories/GHSA-22cw-4ph4-6447
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-42790