Executive brief
OpenSSL is a widely used security library that helps applications establish secure connections. A flaw exists where certain non-standard certificate validation settings can cause the application to crash when it encounters a specific type of security certificate. This results in a denial of service, meaning the affected service becomes unavailable to users, though it does not directly expose sensitive data.
Technical details
A NULL pointer dereference exists in OpenSSL's certificate verification logic. When both X509_V_FLAG_OCSP_RESP_CHECK_ALL (OCSP response checking for the whole chain) and X509_V_FLAG_PARTIAL_CHAIN (partial chain verification) are enabled, the code incorrectly assumes every certificate in the chain has a valid issuer. If the verified chain lacks a self-signed trusted anchor, the issuer for the final certificate is assigned as NULL, leading to a dereference and subsequent crash. This vulnerability is reachable via the network if an application validates a specially crafted or incomplete certificate chain provided by a peer. Both required flags are disabled by default in OpenSSL.
Affected products
- OpenSSL Software Foundation OpenSSL All versions prior to fix (specific versions not listed in text for this CVE)
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory