Erlang OTP’s public_key modules contain an improper certificate validation flaw that enables a DNS nameConstraints bypass through the subject CommonName fallback in TLS hostname verification. The vulnerability allows a subordinate CA whose certificate includes DNS‑based nameConstraints to issue a leaf certificate without a subjectAltName extension. Because the validation routine only checks SAN entries against the nameConstraints, a certificate lacking SAN trivially satisfies the constraint. The openSSL‑compatible hostname verifier then falls back to the CommonName when SAN is missing, accepting the leaf for the intended hostname. This can lead to authentication spoofing and man‑in‑the‑middle attacks, as clients think they are connected to a legitimate server while actually trusting a rogue certificate.

The affected products are Erlang:OTP's OTP releases from 19.3 up to, but not including, 26.2.5.21, 27.3.4.12, 28.5.0.1, and 29.0.1, which correspond to public_key versions 1.4 before 1.15.1.7, 1.17.1.3, 1.20.3.1, and 1.21.1.1. Any environment running these OTP or public_key versions is vulnerable.

The CVSS score of 7.6 indicates moderate‑to‑high severity and the lack of an EPSS rating means the exact exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a TLS client that uses the stock ssl:connect with verify_peer, a trusted CA, and SNI, as well as a strict https hostname matcher. The likely attack vector is an attacker controlling a server that presents a crafted certificate chain; the OTP client will then accept the rogue certificate and establish a trust relationship, enabling impersonation of the target domain. Because the flaw only affects clients, it does not provide remote code execution, but it undermines authentication and confidentiality.