FKIE_CVE-2026-42765

Vulnerability from fkie_nvd - Published: 2026-06-09 17:17 - Updated: 2026-07-23 08:10
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens. This issue affects only applications which enable both OCSP verification of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue. No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.
References
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334Patch
openssl-security@openssl.orghttps://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97Patch
openssl-security@openssl.orghttps://openssl-library.org/news/secadv/20260609.txtVendor Advisory
Impacted products
Vendor Product Version
openssl openssl *
openssl openssl 4.0.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "openssl-security@openssl.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F",
              "versionEndExcluding": "3.6.3",
              "versionStartIncluding": "3.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."
    },
    {
      "lang": "es",
      "value": "Resumen del problema: Cuando la verificaci\u00f3n de certificado de cadena parcial est\u00e1 habilitada junto con la comprobaci\u00f3n de respuesta OCSP para toda la cadena, ocurrir\u00e1 una desreferencia de NULL si la cadena verificada no tiene un ancla de confianza autofirmada, bloqueando el proceso.\n\nResumen del impacto: Una desreferencia de puntero NULL puede desencadenar un bloqueo que lleva a una Denegaci\u00f3n de Servicio para una aplicaci\u00f3n.\n\nAl realizar la comprobaci\u00f3n de respuesta OCSP para certificados en la cadena de verificaci\u00f3n, el c\u00f3digo siempre intenta acceder al siguiente certificado como emisor. Hay una comprobaci\u00f3n para un certificado autofirmado. Sin embargo, con la verificaci\u00f3n de cadena parcial habilitada, cuando la cadena no tiene un ancla de confianza autofirmada, el emisor ser\u00e1 NULL para el \u00faltimo certificado de la cadena. Entonces ocurre una desreferencia de puntero NULL.\n\nEste problema afecta solo a las aplicaciones que habilitan tanto la verificaci\u00f3n OCSP de la cadena de certificados (X509_V_FLAG_OCSP_RESP_CHECK_ALL) como la verificaci\u00f3n de cadena parcial (X509_V_FLAG_PARTIAL_CHAIN) en la verificaci\u00f3n de certificados. Ambas banderas est\u00e1n deshabilitadas por defecto. Por esa raz\u00f3n, hemos asignado una severidad Baja al problema.\n\nNing\u00fan m\u00f3dulo FIPS se ve afectado por este problema ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL."
    }
  ],
  "id": "CVE-2026-42765",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42765",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-09T19:35:48.849695Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T17:17:07.843",
  "references": [
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://openssl-library.org/news/secadv/20260609.txt"
    }
  ],
  "sourceIdentifier": "openssl-security@openssl.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "openssl-security@openssl.org",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.