CVE-2026-42765

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42765", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2026-04-29T09:22:27.968Z", "datePublished": "2026-06-09T16:03:25.934Z", "dateUpdated": "2026-06-10T07:48:00.427Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.3", "status": "affected", "version": "3.6.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Joshua Rogers (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Joshua Rogers (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Kubec"}], "datePublic": "2026-06-09T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: When a partial-chain certificate verification is enabled<br>together with OCSP response checking for the whole chain, a NULL dereference<br>will happen if the verified chain does not have a self-signed trusted anchor,<br>crashing the process.<br><br>Impact summary: A NULL pointer dereference can trigger a crash which leads to a<br>Denial of Service for an application.<br><br>When performing OCSP response checking for certificates in the verification<br>chain, the code always tries to access the next certificate as the issuer.<br>There is a check for a self-signed certificate. However with the partial<br>chain verification enabled when the chain does not have a self-signed trusted<br>anchor, the issuer will be NULL for the last certificate in the chain. A NULL<br>pointer dereference then happens.<br><br>This issue affects only applications which enable both OCSP verification<br>of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial<br>chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate<br>verification. Both flags are disabled by default. For that reason, we have<br>assigned Low severity to the issue.<br><br>No FIPS modules are affected by this issue as the affected code is outside<br>the OpenSSL FIPS module boundary."}], "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}], "metrics": [{"format": "other", "other": {"content": {"text": "Low"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-06-10T07:48:00.427Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20260609.txt"}, {"name": "4.0.1 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334"}, {"name": "3.6.3 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"}], "source": {"discovery": "UNKNOWN"}, "title": "NULL Dereference in Certificate Verification with OCSP Checking", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T19:35:48.849695Z", "id": "CVE-2026-42765", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T19:36:06.889Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-42765", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T19:35:48.849695Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T19:36:01.956Z"}}], "cna": {"title": "NULL Dereference in Certificate Verification with OCSP Checking", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Joshua Rogers (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Joshua Rogers (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Kubec"}], "metrics": [{"other": {"type": "https://openssl-library.org/policies/general/security-policy/", "content": {"text": "Low"}}, "format": "other"}], "affected": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.1", "versionType": "semver"}, {"status": "affected", "version": "3.6.0", "lessThan": "3.6.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-06-09T14:00:00.000Z", "references": [{"url": "https://openssl-library.org/news/secadv/20260609.txt", "name": "OpenSSL Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334", "name": "4.0.1 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97", "name": "3.6.3 git commit", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.", "supportingMedia": [{"type": "text/html", "value": "Issue summary: When a partial-chain certificate verification is enabled<br>together with OCSP response checking for the whole chain, a NULL dereference<br>will happen if the verified chain does not have a self-signed trusted anchor,<br>crashing the process.<br><br>Impact summary: A NULL pointer dereference can trigger a crash which leads to a<br>Denial of Service for an application.<br><br>When performing OCSP response checking for certificates in the verification<br>chain, the code always tries to access the next certificate as the issuer.<br>There is a check for a self-signed certificate. However with the partial<br>chain verification enabled when the chain does not have a self-signed trusted<br>anchor, the issuer will be NULL for the last certificate in the chain. A NULL<br>pointer dereference then happens.<br><br>This issue affects only applications which enable both OCSP verification<br>of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial<br>chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate<br>verification. Both flags are disabled by default. For that reason, we have<br>assigned Low severity to the issue.<br><br>No FIPS modules are affected by this issue as the affected code is outside<br>the OpenSSL FIPS module boundary.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-06-10T07:48:00.427Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42765", "state": "PUBLISHED", "dateUpdated": "2026-06-10T07:48:00.427Z", "dateReserved": "2026-04-29T09:22:27.968Z", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "datePublished": "2026-06-09T16:03:25.934Z", "assignerShortName": "openssl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.3", "status": "affected", "version": "3.6.0", "versionType": "semver"}]}], "source": "openssl-security@openssl.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F", "versionEndExcluding": "3.6.3", "versionStartIncluding": "3.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}, {"lang": "es", "value": "Resumen del problema: Cuando la verificaci\u00f3n de certificado de cadena parcial est\u00e1 habilitada junto con la comprobaci\u00f3n de respuesta OCSP para toda la cadena, ocurrir\u00e1 una desreferencia de NULL si la cadena verificada no tiene un ancla de confianza autofirmada, bloqueando el proceso.\n\nResumen del impacto: Una desreferencia de puntero NULL puede desencadenar un bloqueo que lleva a una Denegaci\u00f3n de Servicio para una aplicaci\u00f3n.\n\nAl realizar la comprobaci\u00f3n de respuesta OCSP para certificados en la cadena de verificaci\u00f3n, el c\u00f3digo siempre intenta acceder al siguiente certificado como emisor. Hay una comprobaci\u00f3n para un certificado autofirmado. Sin embargo, con la verificaci\u00f3n de cadena parcial habilitada, cuando la cadena no tiene un ancla de confianza autofirmada, el emisor ser\u00e1 NULL para el \u00faltimo certificado de la cadena. Entonces ocurre una desreferencia de puntero NULL.\n\nEste problema afecta solo a las aplicaciones que habilitan tanto la verificaci\u00f3n OCSP de la cadena de certificados (X509_V_FLAG_OCSP_RESP_CHECK_ALL) como la verificaci\u00f3n de cadena parcial (X509_V_FLAG_PARTIAL_CHAIN) en la verificaci\u00f3n de certificados. Ambas banderas est\u00e1n deshabilitadas por defecto. Por esa raz\u00f3n, hemos asignado una severidad Baja al problema.\n\nNing\u00fan m\u00f3dulo FIPS se ve afectado por este problema ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL."}], "id": "CVE-2026-42765", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42765", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T19:35:48.849695Z", "version": "2.0.3"}}]}, "published": "2026-06-09T17:17:07.843", "references": [{"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"}, {"source": "openssl-security@openssl.org", "tags": ["Vendor Advisory"], "url": "https://openssl-library.org/news/secadv/20260609.txt"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "openssl-security@openssl.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0,3.6.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenSSL", "source": "cna", "vendor": "OpenSSL"}, "product": "openssl", "vendor": "openssl"}], "created": "2026-06-09T17:45:09.851967+00:00", "updated": "2026-06-09T22:15:15.121798+00:00", "vendors": ["openssl", "openssl$PRODUCT$openssl"]}