Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. OCSP response verification in pubkey_ocsp:verify_response/5 and pubkey_ocsp:is_authorized_responder/3 does not check the validity period (notBefore/notAfter) of the OCSP responder certificate. An attacker who has obtained the private key of an expired CA‑designated OCSP responder certificate can forge OCSP responses that Erlang/OTP accepts as valid. This affects TLS clients using OCSP stapling via the ssl application: a malicious or compromised server can present a revoked TLS certificate together with a forged OCSP response signed by an expired responder key, and the client will accept the revoked certificate as valid. It also affects applications calling public_key:pkix_ocsp_validate/5 directly, where authentication bypass with a revoked client certificate may occur depending on use case.

The vulnerability affects Erlang/OTP releases from 27.0 up to and including 27.3.4.12, as well as OTP 28.5.0.1 and OTP 29.0.1, along with matching public_key libraries 1.16 through 1.17.1.3 (OTP 27), 1.20.3.1 (OTP 28), and 1.21.1 (OTP 29). Users running these versions of Erlang/OTP are at risk. All installations that rely on OCSP stapling via the ssl application or that call public_key:pkix_ocsp_validate/5 directly are potentially impacted.

With a CVSS score of 6.3, the vulnerability poses moderate severity. The EPSS score is < 1 %, and it is not listed in the CISA KEV catalog, indicating no widespread exploitation yet. An attacker who has obtained the private key of an expired OCSP responder certificate can forge responses that an Erlang/OTP client will accept. Attack vector: a malicious or compromised server presenting a revoked certificate alongside a forged OCSP response.