{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42765", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2026-04-29T09:22:27.968Z", "datePublished": "2026-06-09T16:03:25.934Z", "dateUpdated": "2026-06-09T16:03:25.934Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.3", "status": "affected", "version": "3.6.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Joshua Rogers (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Joshua Rogers (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Kubec"}], "datePublic": "2026-06-09T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: When a partial-chain certificate verification is enabled<br>together with OCSP response checking for the whole chain, a NULL dereference<br>will happen if the verified chain does not have a self-signed trusted anchor,<br>crashing the process.<br><br>Impact summary: A NULL pointer dereference can trigger a crash which leads to a<br>Denial of Service for an application.<br><br>When performing OCSP response checking for certificates in the verification<br>chain, the code always tries to access the next certificate as the issuer.<br>There is a check for a self-signed certificate. However with the partial<br>chain verification enabled when the chain does not have a self-signed trusted<br>anchor, the issuer will be NULL for the last certificate in the chain. A NULL<br>pointer dereference then happens.<br><br>This issue affects only applications which enable both OCSP verification<br>of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial<br>chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate<br>verification. Both flags are disabled by default. For that reason, we have<br>assigned Low severity to the issue.<br><br>No FIPS modules are affected by this issue as the affected code is outside<br>the OpenSSL FIPS module boundary."}], "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}], "metrics": [{"format": "other", "other": {"content": {"text": "Low"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-06-09T16:03:25.934Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20260609.txt"}, {"name": "4.0.1 git commit", "tags": ["patch"], "url": "https://github.com/openssl/security/commit/14340b7fa1d444615486bc137014b064e64ec334"}, {"name": "3.6.3 git commit", "tags": ["patch"], "url": "https://github.com/openssl/security/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"}], "source": {"discovery": "UNKNOWN"}, "title": "NULL Dereference in Certificate Verification with OCSP Checking", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}], "id": "CVE-2026-42765", "lastModified": "2026-06-09T17:17:07.843", "metrics": {}, "published": "2026-06-09T17:17:07.843", "references": [{"source": "[email protected]", "url": "https://github.com/openssl/security/commit/14340b7fa1d444615486bc137014b064e64ec334"}, {"source": "[email protected]", "url": "https://github.com/openssl/security/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"}, {"source": "[email protected]", "url": "https://openssl-library.org/news/secadv/20260609.txt"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "[email protected]", "type": "Secondary"}]}

{}

{}