CVE-2026-42767

Name
CVE-2026-42767
Description
Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
openssl-security@openssl.org https://github.com/openssl/security/commit/61a86a8cd73546c9fea916f3d304c1293e05c046
openssl-security@openssl.org https://github.com/openssl/security/commit/665d5254083affde9982efca7c41dd01cacc8774
openssl-security@openssl.org https://github.com/openssl/security/commit/810b722f772652ad48042bcc7ab07e3414b11d0f
openssl-security@openssl.org https://github.com/openssl/security/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873
openssl-security@openssl.org https://github.com/openssl/security/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d
openssl-security@openssl.org https://openssl-library.org/news/secadv/20260609.txt
openssl-security@openssl.org https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046
openssl-security@openssl.org https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774
openssl-security@openssl.org https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f
openssl-security@openssl.org https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873
openssl-security@openssl.org https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* openssl >= 3.0.0 < 3.0.21
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* openssl >= 3.4.0 < 3.4.6
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* openssl >= 3.5.0 < 3.5.7
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* openssl >= 3.6.0 < 3.6.3
cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:* openssl == None == 4.0.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openssl edge-main 3.5.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssl edge-main 3.5.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.5-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.3-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.3-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl edge-main 3.0.8-r0 Ariadne Conill <ariadne@dereferenced.org> possibly vulnerable
openssl edge-main 3.0.7-r2 Ariadne Conill <ariadne@dereferenced.org> possibly vulnerable
openssl edge-main 3.0.7-r0 Ariadne Conill <ariadne@dereferenced.org> possibly vulnerable
openssl edge-main 3.0.6-r0 Ariadne Conill <ariadne@dereferenced.org> possibly vulnerable
openssl edge-main 3.0.5-r0 None possibly vulnerable
openssl edge-main 3.0.3-r0 None possibly vulnerable
openssl edge-main 3.0.2-r0 None possibly vulnerable
openssl edge-main 3.0.1-r0 None possibly vulnerable
openssl 3.24-main 3.5.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssl 3.23-main 3.5.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssl 3.23-main 3.5.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.23-main 3.5.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.23-main 3.5.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssl 3.22-main 3.5.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.3-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssl 3.22-main 3.0.8-r0 None possibly vulnerable
openssl 3.22-main 3.0.7-r2 None possibly vulnerable
openssl 3.22-main 3.0.7-r0 None possibly vulnerable
openssl 3.22-main 3.0.6-r0 None possibly vulnerable
openssl 3.22-main 3.0.5-r0 None possibly vulnerable
openssl 3.22-main 3.0.3-r0 None possibly vulnerable
openssl 3.22-main 3.0.2-r0 None possibly vulnerable
openssl 3.22-main 3.0.1-r0 None possibly vulnerable
openssl 3.21-main 3.0.8-r0 None possibly vulnerable
openssl 3.21-main 3.0.7-r2 None possibly vulnerable
openssl 3.21-main 3.0.7-r0 None possibly vulnerable
openssl 3.21-main 3.0.6-r0 None possibly vulnerable
openssl 3.21-main 3.0.5-r0 None possibly vulnerable
openssl 3.21-main 3.0.3-r0 None possibly vulnerable
openssl 3.21-main 3.0.2-r0 None possibly vulnerable
openssl 3.21-main 3.0.1-r0 None possibly vulnerable
openssl 3.20-main 3.0.8-r0 None possibly vulnerable
openssl 3.20-main 3.0.7-r2 None possibly vulnerable
openssl 3.20-main 3.0.7-r0 None possibly vulnerable
openssl 3.20-main 3.0.6-r0 None possibly vulnerable
openssl 3.20-main 3.0.5-r0 None possibly vulnerable
openssl 3.20-main 3.0.3-r0 None possibly vulnerable
openssl 3.20-main 3.0.2-r0 None possibly vulnerable
openssl 3.20-main 3.0.1-r0 None possibly vulnerable
openssl 3.19-main 3.0.8-r0 None possibly vulnerable
openssl 3.19-main 3.0.7-r2 None possibly vulnerable
openssl 3.19-main 3.0.7-r0 None possibly vulnerable
openssl 3.19-main 3.0.6-r0 None possibly vulnerable
openssl 3.19-main 3.0.5-r0 None possibly vulnerable
openssl 3.19-main 3.0.3-r0 None possibly vulnerable
openssl 3.19-main 3.0.2-r0 None possibly vulnerable
openssl 3.19-main 3.0.1-r0 None possibly vulnerable