https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:39:53 +0000 https://vulnerability.circl.lu/vuln/cve-2026-42765 <p><strong>Affected:</strong> OpenSSL</p> <p>Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process.</p> <p>Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.</p> <p>When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens.</p> <p>This issue affects only applications which enable both OCSP verification of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue.</p> <p>No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.</p> <p><strong>Affected:</strong> OpenSSL</p> <p>Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process.</p> <p>Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.</p> <p>When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens.</p> <p>This issue affects only applications which enable both OCSP verification of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue.</p> <p>No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.</p> https://vulnerability.circl.lu/vuln/cve-2026-42765