Vulnerability-Lookup

CVE-2026-42765 (GCVE-0-2026-42765)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 07:48

Title

NULL Dereference in Certificate Verification with OCSP Checking

Summary

Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens. This issue affects only applications which enable both OCSP verification of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue. No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 19:35 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

openssl CNA under the mitre root

CNA scorecard B 78/100 over 48 records in the last 180 days details

References

3 references

URL	Tags
https://openssl-library.org/news/secadv/20260609.txt	vendor-advisory
https://github.com/openssl/openssl/commit/14340b7…	patch
https://github.com/openssl/openssl/commit/eb345da…	patch

Impacted products

1 product

Vendor	Product	Version	CPE status
OpenSSL	OpenSSL	Affected: 4.0.0 , < 4.0.1 (semver) Affected: 3.6.0 , < 3.6.3 (semver)	guessed

Date Public

2026-06-09 14:00

Credits

Joshua Rogers (Aisle Research) Joshua Rogers (Aisle Research) Daniel Kubec

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:35:48.849695Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T19:36:06.889Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Joshua Rogers (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Joshua Rogers (Aisle Research)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Kubec"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: When a partial-chain certificate verification is enabled\u003cbr\u003etogether with OCSP response checking for the whole chain, a NULL dereference\u003cbr\u003ewill happen if the verified chain does not have a self-signed trusted anchor,\u003cbr\u003ecrashing the process.\u003cbr\u003e\u003cbr\u003eImpact summary: A NULL pointer dereference can trigger a crash which leads to a\u003cbr\u003eDenial of Service for an application.\u003cbr\u003e\u003cbr\u003eWhen performing OCSP response checking for certificates in the verification\u003cbr\u003echain, the code always tries to access the next certificate as the issuer.\u003cbr\u003eThere is a check for a self-signed certificate. However with the partial\u003cbr\u003echain verification enabled when the chain does not have a self-signed trusted\u003cbr\u003eanchor, the issuer will be NULL for the last certificate in the chain. A NULL\u003cbr\u003epointer dereference then happens.\u003cbr\u003e\u003cbr\u003eThis issue affects only applications which enable both OCSP verification\u003cbr\u003eof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\u003cbr\u003echain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\u003cbr\u003everification. Both flags are disabled by default. For that reason, we have\u003cbr\u003eassigned Low severity to the issue.\u003cbr\u003e\u003cbr\u003eNo FIPS modules are affected by this issue as the affected code is outside\u003cbr\u003ethe OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:48:00.427Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "NULL Dereference in Certificate Verification with OCSP Checking",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-42765",
    "datePublished": "2026-06-09T16:03:25.934Z",
    "dateReserved": "2026-04-29T09:22:27.968Z",
    "dateUpdated": "2026-06-10T07:48:00.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42765",
      "date": "2026-11-13",
      "epss": "0.00508",
      "percentile": "0.43962"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-09T01:52:46.000Z",
      "cve": "CVE-2026-42765",
      "id": "msrc_CVE-2026-42765",
      "initial_release_date": "2026-08-07T00:44:30.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "NULL Dereference in Certificate Verification with OCSP Checking",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-42765.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "OpenSSL",
                "vendor": "OpenSSL",
                "versions": [
                  {
                    "lessThan": "4.0.1",
                    "status": "affected",
                    "version": "4.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.6.3",
                    "status": "affected",
                    "version": "3.6.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "openssl-security@openssl.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F",
                    "versionEndExcluding": "3.6.3",
                    "versionStartIncluding": "3.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."
          },
          {
            "lang": "es",
            "value": "Resumen del problema: Cuando la verificaci\u00f3n de certificado de cadena parcial est\u00e1 habilitada junto con la comprobaci\u00f3n de respuesta OCSP para toda la cadena, ocurrir\u00e1 una desreferencia de NULL si la cadena verificada no tiene un ancla de confianza autofirmada, bloqueando el proceso.\n\nResumen del impacto: Una desreferencia de puntero NULL puede desencadenar un bloqueo que lleva a una Denegaci\u00f3n de Servicio para una aplicaci\u00f3n.\n\nAl realizar la comprobaci\u00f3n de respuesta OCSP para certificados en la cadena de verificaci\u00f3n, el c\u00f3digo siempre intenta acceder al siguiente certificado como emisor. Hay una comprobaci\u00f3n para un certificado autofirmado. Sin embargo, con la verificaci\u00f3n de cadena parcial habilitada, cuando la cadena no tiene un ancla de confianza autofirmada, el emisor ser\u00e1 NULL para el \u00faltimo certificado de la cadena. Entonces ocurre una desreferencia de puntero NULL.\n\nEste problema afecta solo a las aplicaciones que habilitan tanto la verificaci\u00f3n OCSP de la cadena de certificados (X509_V_FLAG_OCSP_RESP_CHECK_ALL) como la verificaci\u00f3n de cadena parcial (X509_V_FLAG_PARTIAL_CHAIN) en la verificaci\u00f3n de certificados. Ambas banderas est\u00e1n deshabilitadas por defecto. Por esa raz\u00f3n, hemos asignado una severidad Baja al problema.\n\nNing\u00fan m\u00f3dulo FIPS se ve afectado por este problema ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL."
          }
        ],
        "id": "CVE-2026-42765",
        "lastModified": "2026-07-23T08:10:00.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-42765",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:35:48.849695Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-09T17:17:07.843",
        "references": [
          {
            "source": "openssl-security@openssl.org",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334"
          },
          {
            "source": "openssl-security@openssl.org",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"
          },
          {
            "source": "openssl-security@openssl.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://openssl-library.org/news/secadv/20260609.txt"
          }
        ],
        "sourceIdentifier": "openssl-security@openssl.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "openssl-security@openssl.org",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-11-07T11:48:11+00:00",
      "cve": "CVE-2026-42765",
      "id": "CVE-2026-42765",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:fixed": "70",
      "product_status:known_affected": "62",
      "product_status:known_not_affected": "133",
      "product_status:under_investigation": "12",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssl: NULL Dereference in Certificate Verification with OCSP Checking",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42765.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-11-05T17:42:36Z",
      "cve": "CVE-2026-42765",
      "id": "CVE-2026-42765",
      "initial_release_date": "2026-11-05T17:42:36Z",
      "product_status:known_affected": "25",
      "product_status:known_not_affected": "639",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-42765",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-42765.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.5,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-42765",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-09T19:35:48.849695Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-09T19:36:01.956Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "OpenSSL",
              "vendor": "OpenSSL",
              "versions": [
                {
                  "lessThan": "4.0.1",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "3.6.3",
                  "status": "affected",
                  "version": "3.6.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Joshua Rogers (Aisle Research)"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Joshua Rogers (Aisle Research)"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Daniel Kubec"
            }
          ],
          "datePublic": "2026-06-09T14:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Issue summary: When a partial-chain certificate verification is enabled\u003cbr\u003etogether with OCSP response checking for the whole chain, a NULL dereference\u003cbr\u003ewill happen if the verified chain does not have a self-signed trusted anchor,\u003cbr\u003ecrashing the process.\u003cbr\u003e\u003cbr\u003eImpact summary: A NULL pointer dereference can trigger a crash which leads to a\u003cbr\u003eDenial of Service for an application.\u003cbr\u003e\u003cbr\u003eWhen performing OCSP response checking for certificates in the verification\u003cbr\u003echain, the code always tries to access the next certificate as the issuer.\u003cbr\u003eThere is a check for a self-signed certificate. However with the partial\u003cbr\u003echain verification enabled when the chain does not have a self-signed trusted\u003cbr\u003eanchor, the issuer will be NULL for the last certificate in the chain. A NULL\u003cbr\u003epointer dereference then happens.\u003cbr\u003e\u003cbr\u003eThis issue affects only applications which enable both OCSP verification\u003cbr\u003eof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\u003cbr\u003echain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\u003cbr\u003everification. Both flags are disabled by default. For that reason, we have\u003cbr\u003eassigned Low severity to the issue.\u003cbr\u003e\u003cbr\u003eNo FIPS modules are affected by this issue as the affected code is outside\u003cbr\u003ethe OpenSSL FIPS module boundary."
                }
              ],
              "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."
            }
          ],
          "metrics": [
            {
              "format": "other",
              "other": {
                "content": {
                  "text": "Low"
                },
                "type": "https://openssl-library.org/policies/general/security-policy/"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-476",
                  "description": "CWE-476 NULL Pointer Dereference",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-10T07:48:00.427Z",
            "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
            "shortName": "openssl"
          },
          "references": [
            {
              "name": "OpenSSL Advisory",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://openssl-library.org/news/secadv/20260609.txt"
            },
            {
              "name": "4.0.1 git commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334"
            },
            {
              "name": "3.6.3 git commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "NULL Dereference in Certificate Verification with OCSP Checking",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "assignerShortName": "openssl",
        "cveId": "CVE-2026-42765",
        "datePublished": "2026-06-09T16:03:25.934Z",
        "dateReserved": "2026-04-29T09:22:27.968Z",
        "dateUpdated": "2026-06-10T07:48:00.427Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BELL-CVE-2026-42765 (CVE-2026-42765)

Vulnerability from osv_bellsoft – Published: 2026-06-11 06:12 – Updated: 2026-06-12 06:08 – Source website

Withdrawn 2026-06-12

Summary

CVE-2026-42765 does not affect BellSoft software

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

https://docs.bell-sw.com/security/cves/CVE-2026-42765

ADVISORY

JSON

To clipboard

{
  "id": "BELL-CVE-2026-42765",
  "modified": "2026-06-12T06:08:56.411532Z",
  "published": "2026-06-11T06:12:00.676670Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://docs.bell-sw.com/security/cves/CVE-2026-42765"
    }
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CVE-2026-42765 does not affect BellSoft software",
  "upstream": [
    "CVE-2026-42765"
  ],
  "withdrawn": "2026-06-12T06:08:56.411532Z"
}

CERTFR-2026-AVI-0717

Vulnerability from certfr_avis - Published: 2026-06-10 - Updated: 2026-06-10

De multiples vulnérabilités ont été découvertes dans OpenSSL. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
OpenSSL	OpenSSL	OpenSSL versions 1.0.x antérieures à 1.0.2zq
OpenSSL	OpenSSL	OpenSSL versions 4.x antérieures à 4.0.1
OpenSSL	OpenSSL	OpenSSL versions 3.5.x antérieures à 3.5.7
OpenSSL	OpenSSL	OpenSSL versions 1.1.x antérieures à 1.1.1zh
OpenSSL	OpenSSL	OpenSSL versions 3.x antérieures à 3.0.21
OpenSSL	OpenSSL	OpenSSL versions 3.6.x antérieures à 3.6.3
OpenSSL	OpenSSL	OpenSSL versions 3.4.x antérieures à 3.4.6

References

Title

Publication Time

CERTFR-2026-AVI-0796

Vulnerability from certfr_avis - Published: 2026-06-24 - Updated: 2026-06-24

De multiples vulnérabilités ont été découvertes dans Tenable Identity Exposure. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Tenable	Identity Exposure	Tenable Identity Exposure versions antérieures à v3.93.5

References

Title

Publication Time

FKIE_CVE-2026-42765

Vulnerability from fkie_nvd - Published: 2026-06-09 17:17 - Updated: 2026-07-23 08:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
openssl-security@openssl.org	https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334	Patch
openssl-security@openssl.org	https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97	Patch
openssl-security@openssl.org	https://openssl-library.org/news/secadv/20260609.txt	Vendor Advisory

Impacted products

	Vendor	Product	Version
	openssl	openssl	*
	openssl	openssl	4.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "openssl-security@openssl.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F",
              "versionEndExcluding": "3.6.3",
              "versionStartIncluding": "3.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."
    },
    {
      "lang": "es",
      "value": "Resumen del problema: Cuando la verificaci\u00f3n de certificado de cadena parcial est\u00e1 habilitada junto con la comprobaci\u00f3n de respuesta OCSP para toda la cadena, ocurrir\u00e1 una desreferencia de NULL si la cadena verificada no tiene un ancla de confianza autofirmada, bloqueando el proceso.\n\nResumen del impacto: Una desreferencia de puntero NULL puede desencadenar un bloqueo que lleva a una Denegaci\u00f3n de Servicio para una aplicaci\u00f3n.\n\nAl realizar la comprobaci\u00f3n de respuesta OCSP para certificados en la cadena de verificaci\u00f3n, el c\u00f3digo siempre intenta acceder al siguiente certificado como emisor. Hay una comprobaci\u00f3n para un certificado autofirmado. Sin embargo, con la verificaci\u00f3n de cadena parcial habilitada, cuando la cadena no tiene un ancla de confianza autofirmada, el emisor ser\u00e1 NULL para el \u00faltimo certificado de la cadena. Entonces ocurre una desreferencia de puntero NULL.\n\nEste problema afecta solo a las aplicaciones que habilitan tanto la verificaci\u00f3n OCSP de la cadena de certificados (X509_V_FLAG_OCSP_RESP_CHECK_ALL) como la verificaci\u00f3n de cadena parcial (X509_V_FLAG_PARTIAL_CHAIN) en la verificaci\u00f3n de certificados. Ambas banderas est\u00e1n deshabilitadas por defecto. Por esa raz\u00f3n, hemos asignado una severidad Baja al problema.\n\nNing\u00fan m\u00f3dulo FIPS se ve afectado por este problema ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL."
    }
  ],
  "id": "CVE-2026-42765",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42765",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-09T19:35:48.849695Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T17:17:07.843",
  "references": [
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"
    },
    {
      "source": "openssl-security@openssl.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://openssl-library.org/news/secadv/20260609.txt"
    }
  ],
  "sourceIdentifier": "openssl-security@openssl.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "openssl-security@openssl.org",
      "type": "Secondary"
    }
  ]
}

GHSA-VM8W-J6FW-JC7R

Vulnerability from github – Published: 2026-06-09 18:30 – Updated: 2026-06-10 09:31

Details

Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.

When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens.

This issue affects only applications which enable both OCSP verification of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue.

No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-42765"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-09T17:17:07Z",
    "severity": "HIGH"
  },
  "details": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.",
  "id": "GHSA-vm8w-j6fw-jc7r",
  "modified": "2026-06-10T09:31:56Z",
  "published": "2026-06-09T18:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42765"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/security/commit/14340b7fa1d444615486bc137014b064e64ec334"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openssl/security/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97"
    },
    {
      "type": "WEB",
      "url": "https://openssl-library.org/news/secadv/20260609.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-42765

Vulnerability from csaf_microsoft - Published: 2026-08-07 00:44 - Updated: 2026-09-09 01:52

Summary

NULL Dereference in Certificate Verification with OCSP Checking

Scope

1 vulnerability in this advisory, including CVE-2026-42765.

CVE-2026-42765

Known not affected: 2 products

Open the full advisory

RHSA-2026:42825

Vulnerability from csaf_redhat - Published: 2026-07-21 14:13 - Updated: 2026-11-12 17:19

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

21 vulnerabilities in this advisory, including CVE-2026-42765.

CVE-2026-42765

A flaw was found in OpenSSL. When an application is configured with specific non-default settings for certificate verification, including both Online Certificate Status Protocol (OCSP) response checking and partial chain verification, a NULL dereference can occur. This vulnerability can be triggered if the certificate chain lacks a self-signed trusted anchor, causing the application to crash. This leads to a Denial of Service (DoS) for the affected application.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:42825

Open the full advisory

RHSA-2026:55543

Vulnerability from csaf_redhat - Published: 2026-08-17 09:22 - Updated: 2026-11-13 12:47

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

24 vulnerabilities in this advisory, including CVE-2026-42765.

CVE-2026-42765

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:55543

Open the full advisory

RHSA-2026:59635

Vulnerability from csaf_redhat - Published: 2026-08-25 21:50 - Updated: 2026-11-11 11:20

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

27 vulnerabilities in this advisory, including CVE-2026-42765.

CVE-2026-42765

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 7 products

https://access.redhat.com/errata/RHSA-2026:59635

Open the full advisory

RHSA-2026:59641

Vulnerability from csaf_redhat - Published: 2026-08-25 21:57 - Updated: 2026-11-11 11:20

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

28 vulnerabilities in this advisory, including CVE-2026-42765.

CVE-2026-42765

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 15 products

https://access.redhat.com/errata/RHSA-2026:59641

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-42765 (GCVE-0-2026-42765)

BELL-CVE-2026-42765 (CVE-2026-42765)

Solutions

Solutions

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour