CVE-2026-42765

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42765
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42765.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42765
Downstream
Related
Published
2026-06-09T16:03:25.934Z
Modified
2026-07-08T08:13:26.563754494Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
NULL Dereference in Certificate Verification with OCSP Checking
Details

Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process.

Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.

When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens.

This issue affects only applications which enable both OCSP verification of the certificate chain (X509VFLAGOCSPRESPCHECKALL) and partial chain verification (X509VFLAGPARTIALCHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue.

No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42765.json",
    "cna_assigner": "openssl",
    "cwe_ids": [
        "CWE-476"
    ]
}
References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type
GIT
Repo
https://github.com/openssl/openssl
Events
Introduced
7b371d80d959ec9ab4139d09d78e83c090de9779
Fixed
aae016bfd52fcad2bc9657c2c782cfdf73b1ed5f
Introduced
11b7b6ea3b65a584e1d31408ed1bdb139465cffd
Fixed
14340b7fa1d444615486bc137014b064e64ec334
Fixed
eb345da18ce2216b2f3ade9c2bc23e068487fa97
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.3"
        },
        {
            "introduced": "4.0.0-NA"
        },
        {
            "last_affected": "4.0.0-NA"
        }
    ]
}

Affected versions

3.*
3.6-POST-CLANG-FORMAT-WEBKIT
3.6-PRE-CLANG-FORMAT-WEBKIT
4.*
4.0.0-NA
openssl-3.*
openssl-3.6.0
openssl-3.6.1
openssl-3.6.2
openssl-4.*
openssl-4.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42765.json"