Vulnerability-Lookup

FKIE_CVE-2026-42764

Vulnerability from fkie_nvd - Published: 2026-06-09 17:17 - Updated: 2026-07-23 08:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

References

URL	Tags
openssl-security@openssl.org	https://github.com/openssl/openssl/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729	Patch
openssl-security@openssl.org	https://github.com/openssl/openssl/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677	Patch
openssl-security@openssl.org	https://github.com/openssl/openssl/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91	Patch
openssl-security@openssl.org	https://openssl-library.org/news/secadv/20260609.txt	Vendor Advisory

Impacted products

Vendor	Product	Version
openssl	openssl	*
openssl	openssl	*
openssl	openssl	4.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "openssl-security@openssl.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B6B9930-C549-4D88-9784-AF32CCDDB87A",
              "versionEndExcluding": "3.5.7",
              "versionStartIncluding": "3.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F",
              "versionEndExcluding": "3.6.3",
              "versionStartIncluding": "3.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Issue summary: Receiving a QUIC initial packet with an invalid token may\ntrigger a NULL pointer dereference in the OpenSSL QUIC server with\naddress validation disabled.\n\nImpact summary: NULL pointer dereference typically causes abnormal termination\nof the affected QUIC server process and a Denial of Service.\n\nIf the address validation is disabled in the OpenSSL QUIC server\nimplementation, an attacker can crash the server by sending an initial\npacket with an invalid or expired token.\n\nBy default, the client address validation is enabled in the OpenSSL QUIC server\nimplementation, which makes the default configuration not vulnerable\nto this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with\nthe SSL_new_listener() call, the address validation is disabled making the\nvulnerable code reachable.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."
    },
    {
      "lang": "es",
      "value": "Resumen del problema: Recibir un paquete inicial QUIC con un token inv\u00e1lido puede desencadenar una desreferencia de puntero NULL en el servidor QUIC de OpenSSL con la validaci\u00f3n de direcciones deshabilitada.\n\nResumen del impacto: La desreferencia de puntero NULL t\u00edpicamente causa la terminaci\u00f3n anormal del proceso del servidor QUIC afectado y una denegaci\u00f3n de servicio.\n\nSi la validaci\u00f3n de direcciones est\u00e1 deshabilitada en la implementaci\u00f3n del servidor QUIC de OpenSSL, un atacante puede bloquear el servidor enviando un paquete inicial con un token inv\u00e1lido o caducado.\n\nPor defecto, la validaci\u00f3n de direcciones del cliente est\u00e1 habilitada en la implementaci\u00f3n del servidor QUIC de OpenSSL, lo que hace que la configuraci\u00f3n predeterminada no sea vulnerable a este problema. Sin embargo, si se utiliza SSL_LISTENER_FLAG_NO_VALIDATE con la llamada a SSL_new_listener(), la validaci\u00f3n de direcciones se deshabilita, haciendo que el c\u00f3digo vulnerable sea accesible.\n\nLos m\u00f3dulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 no se ven afectados por este problema, ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL."
    }
  ],
  "id": "CVE-2026-42764",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42764",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-09T19:36:40.693568Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T17:17:07.693",
  "references": [
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://openssl-library.org/news/secadv/20260609.txt"
    }
  ],
  "sourceIdentifier": "openssl-security@openssl.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "openssl-security@openssl.org",
      "type": "Secondary"
    }
  ]
}

CVE-2026-42764 (GCVE-0-2026-42764)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 07:47

Title

NULL Pointer Dereference in QUIC Server Initial Packet Handling

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-476 - NULL Pointer Dereference

Assigner

openssl

References

4 references

URL	Tags
https://openssl-library.org/news/secadv/20260609.txt	vendor-advisory
https://github.com/openssl/openssl/commit/bf29a45…	patch
https://github.com/openssl/openssl/commit/a45a0ab…	patch
https://github.com/openssl/openssl/commit/5e3ed29…	patch

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.1 (semver) Affected: 3.6.0 , < 3.6.3 (semver) Affected: 3.5.0 , < 3.5.7 (semver)

Date Public

2026-06-09 14:00

Credits

Sunwoo Lee (KENTECH) Hyuk Lim (KENTECH) Seunghyun Yoon (KENTECH) Sunwoo Lee (KENTECH) Hyuk Lim (KENTECH) Seunghyun Yoon (KENTECH)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42764",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:36:40.693568Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T19:37:01.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Sunwoo Lee (KENTECH)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Hyuk Lim (KENTECH)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Seunghyun Yoon (KENTECH)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Sunwoo Lee (KENTECH)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Hyuk Lim (KENTECH)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Seunghyun Yoon (KENTECH)"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Receiving a QUIC initial packet with an invalid token may\u003cbr\u003etrigger a NULL pointer dereference in the OpenSSL QUIC server with\u003cbr\u003eaddress validation disabled.\u003cbr\u003e\u003cbr\u003eImpact summary: NULL pointer dereference typically causes abnormal termination\u003cbr\u003eof the affected QUIC server process and a Denial of Service.\u003cbr\u003e\u003cbr\u003eIf the address validation is disabled in the OpenSSL QUIC server\u003cbr\u003eimplementation, an attacker can crash the server by sending an initial\u003cbr\u003epacket with an invalid or expired token.\u003cbr\u003e\u003cbr\u003eBy default, the client address validation is enabled in the OpenSSL QUIC server\u003cbr\u003eimplementation, which makes the default configuration not vulnerable\u003cbr\u003eto this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with\u003cbr\u003ethe SSL_new_listener() call, the address validation is disabled making the\u003cbr\u003evulnerable code reachable.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\u003cbr\u003eissue, as the affected code is outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: Receiving a QUIC initial packet with an invalid token may\ntrigger a NULL pointer dereference in the OpenSSL QUIC server with\naddress validation disabled.\n\nImpact summary: NULL pointer dereference typically causes abnormal termination\nof the affected QUIC server process and a Denial of Service.\n\nIf the address validation is disabled in the OpenSSL QUIC server\nimplementation, an attacker can crash the server by sending an initial\npacket with an invalid or expired token.\n\nBy default, the client address validation is enabled in the OpenSSL QUIC server\nimplementation, which makes the default configuration not vulnerable\nto this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with\nthe SSL_new_listener() call, the address validation is disabled making the\nvulnerable code reachable.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Moderate"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:47:58.940Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "NULL Pointer Dereference in QUIC Server Initial Packet Handling",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-42764",
    "datePublished": "2026-06-09T16:03:25.161Z",
    "dateReserved": "2026-04-29T09:22:27.967Z",
    "dateUpdated": "2026-06-10T07:47:58.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

FKIE_CVE-2026-42764

CVE-2026-42764 (GCVE-0-2026-42764)

Tags

Sightings

Nomenclature