7.5

CVE-2026-42765: openssl NULL Pointer Dereference

CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-42765DEBIAN-CVE-2026-42765CGA-423r-p3g2-v2wq
Published 09-06-2026Last modified 10-06-2026
Open JSON

Vulnerability summary

CVE-2026-42765 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in openssl. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 39.8% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.48%
0%100%
Low · -0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 1
RHSA-2026:42825RHSA-2026:55543RHSA-2026:59635RHSA-2026:59641RHSA-2026:62562RHSA-2026:62563

Timeline

  1. 09-06-2026
    PublishedVulnerability first disclosed.
  2. 10-06-2026
    Last modifiedVulnerability information updated.

Description

Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens. This issue affects only applications which enable both OCSP verification of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue. No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.48%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

-0.03 pp

From 0.51% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard5 products
  • libcrypto3< 3.6.3-r0
  • libcrypto3-2.34< 3.6.3-r0
  • openssl< 3.6.3-r0
  • openssl-provider-fips-3.6.0All versions (No fix recorded)
  • openssl-provider-fips-3.6.0-dbgAll versions (No fix recorded)
Wolfi2 products
  • libcrypto3< 3.6.3-r0
  • openssl< 3.6.3-r0
Debian1 product
  • openssl< 3.6.3-1
Openssl1 product
  • openssl≥ 4.0.0, < 4.0.1 | ≥ 3.6.0, < 3.6.3 | 4.0.0
Ubuntu1 product
  • nodejsAll versions (No fix recorded)

5 vendors · 10 products

References

8 links