SUSE-SU-2026:22082-1

CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).
CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
CVE-2026-42791: OCSP response verification in the public_key application does not check the validity period of the OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

27.1.3-160000.5.1

{
    "binaries": [
        {
            "erlang-epmd": "27.1.3-160000.5.1",
            "erlang": "27.1.3-160000.5.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22082-1.json"

Name: erlang
Purl: pkg:rpm/suse/erlang&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

27.1.3-160000.5.1

{
    "binaries": [
        {
            "erlang-epmd": "27.1.3-160000.5.1",
            "erlang": "27.1.3-160000.5.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22082-1.json"