7.5

CVE-2026-42764: NULL Pointer Dereference in QUIC Server Initial Packet Handling

Analyzed
AliasesALPINE-CVE-2026-42764UBUNTU-CVE-2026-42764DEBIAN-CVE-2026-42764
Published 09-06-2026Last modified 10-06-2026

Vulnerability summary

CVE-2026-42764 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in openssl. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 67.3% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.17%
0%100%
Low · +0.39 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 7
MGASA-2026-0253OPENSUSE-SU-2026:11023-1OPENSUSE-SU-2026:21005-1RHSA-2026:25237RHSA-2026:25239RHSA-2026:42825

Timeline

  1. 09-06-2026
    PublishedVulnerability first disclosed.
  2. 10-06-2026
    Last modifiedVulnerability information updated.

Description

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.17%

Chance of exploitation in the next 30 days

Percentile

67%

Versus all other CVEs

30-day change

Increase +0.39 pp

From 0.78% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard12 products
  • libcrypto3< 3.6.3-r0
  • libcrypto3-2.34< 3.6.3-r0
  • openssl< 3.6.3-r0
  • openssl-3.5< 3.5.7-r0
  • openssl-3.5-libcrypto< 3.5.7-r0
Wolfi5 products
  • libcrypto3< 3.6.3-r0
  • openssl< 3.6.3-r0
  • openssl-4.0< 4.0.1-r0
  • openssl-4.0-libcrypto< 4.0.1-r0
  • openssl-4.0-libssl< 4.0.1-r0
Ubuntu4 products
  • edk2All versions (No fix recorded)
  • edk2-hweAll versions (No fix recorded)
  • nodejsAll versions (No fix recorded)
  • openssl< 3.5.3-1ubuntu3.4 | < 3.5.5-1ubuntu3.2
Alpine1 product
  • openssl≥ 3.5.0, < 3.5.7-r0
Debian1 product
  • openssl< 3.5.6-1~deb13u2 | < 3.6.3-1
Openssl1 product
  • openssl≥ 4.0.0, < 4.0.1 | ≥ 3.5.0, < 3.5.7 | ≥ 3.6.0, < 3.6.3 | 4.0.0

6 vendors · 24 products

References

11 links
Show all 11 references