CVE-2026-14457

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14457
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14457.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14457
Downstream
ALPINE (1)
ALSA (2)
BELL (1)
CGA (28)
CLEANSTART (1)
CLSA (1)
DEBIAN (1)
MGASA (1)
MINI (1)
OESA (1)
openSUSE (2)
RHSA (4)
RLSA (2)
SUSE (9)
UBUNTU (1)
Related
ALSA (2)
openSUSE (2)
SUSE (9)
Published
2026-08-25T12:58:29Z
Modified
2026-10-28T11:07:38Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate
Details

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension.

Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible.

CWE: CWE-476: NULL Pointer Dereference

Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA).

When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key.

Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below.

FIPS impact: no

No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.

Database specific 
{
    "cna_assigner":  "openssl",
    "cwe_ids":  [
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14457.json"
}
References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
98acb6b02839c609ef5b837794e08d906d965335
Fixed
0c5d912057abf47505b4ad455da49fbab99b76f1
Introduced
636dfadc70ce26f2473870570bfd9ec352806b1d
Fixed
f4dc4d58b48d346a8270183f89acf826d459b0ca
Introduced
7b371d80d959ec9ab4139d09d78e83c090de9779
Fixed
d3c1b1169b3569ff3069e5b399f47b2b28e03d79
Introduced
11b7b6ea3b65a584e1d31408ed1bdb139465cffd
Fixed
f089acdf4bc7ba94a79f4bf6eb7362c3e7d14aa9
Fixed
1e8c398db67404babd3e5af999bb6bd86f720c76
Fixed
581aaa0f0a35d214740f0fe1f5283ec41f1212e1
Fixed
d0af20478688a6aa2f59d61caa3f82136b181d7f
Fixed
dad836b071da6579510c968615848ba03cac593b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.4.0"
                },
                {
                    "fixed":  "3.4.7"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.5.0"
                },
                {
                    "fixed":  "3.5.8"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.6.0"
                },
                {
                    "fixed":  "3.6.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.0.0"
                },
                {
                    "fixed":  "4.0.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "1e8c398db67404babd3e5af999bb6bd86f720c76"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "581aaa0f0a35d214740f0fe1f5283ec41f1212e1"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "d0af20478688a6aa2f59d61caa3f82136b181d7f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "dad836b071da6579510c968615848ba03cac593b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*
3.4-POST-CLANG-FORMAT-WEBKIT
3.4-PRE-CLANG-FORMAT-WEBKIT
3.5-POST-CLANG-FORMAT-WEBKIT
3.5-PRE-CLANG-FORMAT-WEBKIT
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
openssl-3.*
openssl-3.4.0
openssl-3.4.1
openssl-3.4.2
openssl-3.4.3
openssl-3.4.4
openssl-3.4.5
openssl-3.4.6
openssl-3.5.0
openssl-3.5.1
openssl-3.5.2
openssl-3.5.3
openssl-3.5.4
openssl-3.5.5
openssl-3.5.6
openssl-3.5.7
openssl-3.6.0
openssl-3.6.1
openssl-3.6.2
openssl-3.6.3
openssl-4.*
openssl-4.0.0
openssl-4.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14457.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "240680566283557418249811217090809119159",
            "length":  779
        },
        "id":  "CVE-2026-14457-07d830f7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1",
        "target":  {
            "file":  "ssl/t1_lib.c",
            "function":  "check_cert_usable"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "240680566283557418249811217090809119159",
            "length":  779
        },
        "id":  "CVE-2026-14457-11813fc8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b",
        "target":  {
            "file":  "ssl/t1_lib.c",
            "function":  "check_cert_usable"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "291482783549067872189591333746644407791",
                "279168425914636865538460648533761044404",
                "313662912980730051430453490059999240807",
                "172330435681988368224652713975087998320",
                "79348242123300071255461705865728451067",
                "253318157315554747518617644892236498399",
                "189274192517390090312170992303948865598",
                "103428685406461815783767458538708378293",
                "302397085750011765242534116280152930511",
                "68229802511724053235226972829764555507",
                "137503151956394106712860705269232624226",
                "278346535311547155124499228774287136057",
                "132965208910597884112622702953000212959",
                "67707989337570131683600526672568085192",
                "51574907235080877678178833899452097384"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14457-1c4b2e8e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1",
        "target":  {
            "file":  "test/rpktest.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "226923715781324276311275518904245517821",
                "334566769751649571783630132307599835883",
                "200542353466665015192127317739016718757"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14457-270c51f3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76",
        "target":  {
            "file":  "ssl/t1_lib.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "291482783549067872189591333746644407791",
                "279168425914636865538460648533761044404",
                "313662912980730051430453490059999240807",
                "172330435681988368224652713975087998320",
                "79348242123300071255461705865728451067",
                "253318157315554747518617644892236498399",
                "189274192517390090312170992303948865598",
                "103428685406461815783767458538708378293",
                "302397085750011765242534116280152930511",
                "68229802511724053235226972829764555507",
                "137503151956394106712860705269232624226",
                "278346535311547155124499228774287136057",
                "132965208910597884112622702953000212959",
                "67707989337570131683600526672568085192",
                "51574907235080877678178833899452097384"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14457-35c95623",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76",
        "target":  {
            "file":  "test/rpktest.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "291482783549067872189591333746644407791",
                "279168425914636865538460648533761044404",
                "313662912980730051430453490059999240807",
                "172330435681988368224652713975087998320",
                "79348242123300071255461705865728451067",
                "253318157315554747518617644892236498399",
                "189274192517390090312170992303948865598",
                "103428685406461815783767458538708378293",
                "302397085750011765242534116280152930511",
                "68229802511724053235226972829764555507",
                "137503151956394106712860705269232624226",
                "278346535311547155124499228774287136057",
                "132965208910597884112622702953000212959",
                "67707989337570131683600526672568085192",
                "51574907235080877678178833899452097384"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14457-378fc360",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b",
        "target":  {
            "file":  "test/rpktest.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "291482783549067872189591333746644407791",
                "279168425914636865538460648533761044404",
                "313662912980730051430453490059999240807",
                "172330435681988368224652713975087998320",
                "79348242123300071255461705865728451067",
                "253318157315554747518617644892236498399",
                "189274192517390090312170992303948865598",
                "103428685406461815783767458538708378293",
                "302397085750011765242534116280152930511",
                "68229802511724053235226972829764555507",
                "137503151956394106712860705269232624226",
                "278346535311547155124499228774287136057",
                "132965208910597884112622702953000212959",
                "67707989337570131683600526672568085192",
                "51574907235080877678178833899452097384"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14457-49db64d6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f",
        "target":  {
            "file":  "test/rpktest.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "226923715781324276311275518904245517821",
                "334566769751649571783630132307599835883",
                "200542353466665015192127317739016718757"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14457-71115cdb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b",
        "target":  {
            "file":  "ssl/t1_lib.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "5502367711826326480058108979067620677",
            "length":  13077
        },
        "id":  "CVE-2026-14457-870cee60",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f",
        "target":  {
            "file":  "test/rpktest.c",
            "function":  "test_rpk"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "5502367711826326480058108979067620677",
            "length":  13077
        },
        "id":  "CVE-2026-14457-90a00ac9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b",
        "target":  {
            "file":  "test/rpktest.c",
            "function":  "test_rpk"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "226923715781324276311275518904245517821",
                "334566769751649571783630132307599835883",
                "200542353466665015192127317739016718757"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14457-9fef85f3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1",
        "target":  {
            "file":  "ssl/t1_lib.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "226923715781324276311275518904245517821",
                "334566769751649571783630132307599835883",
                "200542353466665015192127317739016718757"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-14457-a14bbd18",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f",
        "target":  {
            "file":  "ssl/t1_lib.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "5502367711826326480058108979067620677",
            "length":  13077
        },
        "id":  "CVE-2026-14457-a72e4f65",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1",
        "target":  {
            "file":  "test/rpktest.c",
            "function":  "test_rpk"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "5502367711826326480058108979067620677",
            "length":  13077
        },
        "id":  "CVE-2026-14457-ba95d599",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76",
        "target":  {
            "file":  "test/rpktest.c",
            "function":  "test_rpk"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "260361621803463944158332166492711754274",
            "length":  766
        },
        "id":  "CVE-2026-14457-caeb8d18",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76",
        "target":  {
            "file":  "ssl/t1_lib.c",
            "function":  "check_cert_usable"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "240680566283557418249811217090809119159",
            "length":  779
        },
        "id":  "CVE-2026-14457-d902894d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f",
        "target":  {
            "file":  "ssl/t1_lib.c",
            "function":  "check_cert_usable"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:07:38Z"