CVE-2026-42765: NULL Dereference in Certificate Verification with OCSP Checking
Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process.
Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.
When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens.
This issue affects only applications which enable both OCSP verification of the certificate chain (X509VFLAGOCSPRESPCHECKALL) and partial chain verification (X509VFLAGPARTIALCHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue.
No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not enable X509_V_FLAG_OCSP_RESP_CHECK_ALL (OCSP response checking for the whole chain) when X509_V_FLAG_PARTIAL_CHAIN is enabled. Disable X509_V_FLAG_OCSP_RESP_CHECK_ALL in your certificate verification flags to avoid a NULL pointer dereference.
OpenSSL certificate verification X509_V_FLAG_OCSP_RESP_CHECK_ALL = disabled - Configuration
Do not enable X509_V_FLAG_PARTIAL_CHAIN (partial chain verification) together with X509_V_FLAG_OCSP_RESP_CHECK_ALL. Disable X509_V_FLAG_PARTIAL_CHAIN in your certificate verification flags if you require OCSP response checking for the whole chain.
OpenSSL certificate verification X509_V_FLAG_PARTIAL_CHAIN = disabled - Operational
If your application currently enables both X509_V_FLAG_OCSP_RESP_CHECK_ALL and X509_V_FLAG_PARTIAL_CHAIN, disable one of the flags and restart or reload the application to remove the unsafe configuration. Do not enable both flags simultaneously until a fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42765?
CVE-2026-42765 has a severity rating of high, with a score of 7.5 according to CVSS 3.1.
What causes the NULL dereference in CVE-2026-42765?
The NULL dereference in CVE-2026-42765 is caused by a failure to verify that the certificate chain includes a self-signed trusted anchor when OCSP checking is enabled.
How does CVE-2026-42765 impact the OpenSSL process?
CVE-2026-42765 causes the OpenSSL process to crash due to a NULL pointer dereference when the certificate chain does not contain the necessary trusted anchor.
How do I mitigate CVE-2026-42765?
To mitigate CVE-2026-42765, ensure that the certificate verification process includes a self-signed trusted anchor in the chain.
What software versions are affected by CVE-2026-42765?
CVE-2026-42765 affects OpenSSL implementations that support partial-chain certificate verification with OCSP response checking.