CVE-2026-42765

{"id": "CVE-2026-42765", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42765", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T19:35:48.849695Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "openssl-security@openssl.org", "affectedData": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.1", "versionType": "semver"}, {"status": "affected", "version": "3.6.0", "lessThan": "3.6.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T17:17:07.843", "references": [{"url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97", "tags": ["Patch"], "source": "openssl-security@openssl.org"}, {"url": "https://openssl-library.org/news/secadv/20260609.txt", "tags": ["Vendor Advisory"], "source": "openssl-security@openssl.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "openssl-security@openssl.org", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}, {"lang": "es", "value": "Resumen del problema: Cuando la verificaci\u00f3n de certificado de cadena parcial est\u00e1 habilitada junto con la comprobaci\u00f3n de respuesta OCSP para toda la cadena, ocurrir\u00e1 una desreferencia de NULL si la cadena verificada no tiene un ancla de confianza autofirmada, bloqueando el proceso.\n\nResumen del impacto: Una desreferencia de puntero NULL puede desencadenar un bloqueo que lleva a una Denegaci\u00f3n de Servicio para una aplicaci\u00f3n.\n\nAl realizar la comprobaci\u00f3n de respuesta OCSP para certificados en la cadena de verificaci\u00f3n, el c\u00f3digo siempre intenta acceder al siguiente certificado como emisor. Hay una comprobaci\u00f3n para un certificado autofirmado. Sin embargo, con la verificaci\u00f3n de cadena parcial habilitada, cuando la cadena no tiene un ancla de confianza autofirmada, el emisor ser\u00e1 NULL para el \u00faltimo certificado de la cadena. Entonces ocurre una desreferencia de puntero NULL.\n\nEste problema afecta solo a las aplicaciones que habilitan tanto la verificaci\u00f3n OCSP de la cadena de certificados (X509_V_FLAG_OCSP_RESP_CHECK_ALL) como la verificaci\u00f3n de cadena parcial (X509_V_FLAG_PARTIAL_CHAIN) en la verificaci\u00f3n de certificados. Ambas banderas est\u00e1n deshabilitadas por defecto. Por esa raz\u00f3n, hemos asignado una severidad Baja al problema.\n\nNing\u00fan m\u00f3dulo FIPS se ve afectado por este problema ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL."}], "lastModified": "2026-07-23T08:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F", "versionEndExcluding": "3.6.3", "versionStartIncluding": "3.6.0"}, {"criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D"}], "operator": "OR"}]}], "sourceIdentifier": "openssl-security@openssl.org"}