CVE-2026-42765: NULL Dereference in Certificate Verification with OCSP Checking
Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process.
Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.
When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens.
This issue affects only applications which enable both OCSP verification of the certificate chain (X509VFLAGOCSPRESPCHECKALL) and partial chain verification (X509VFLAGPARTIALCHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue.
No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.
Other sources
NULL Dereference in Certificate Verification with OCSP Checking
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable partial-chain certificate verification so that the OpenSSL code path that dereferences a NULL issuer for the last certificate in the chain is not used.
OpenSSL certificate verification X509_V_FLAG_PARTIAL_CHAIN = disabled - Configuration
Disable OCSP response checking for the whole chain; the NULL pointer dereference occurs when OCSP response checking is enabled together with partial-chain certificate verification.
OpenSSL certificate verification X509_V_FLAG_OCSP_RESP_CHECK_ALL = disabled - Configuration
Ensure you do not enable both flags at the same time, because the crash happens only when both partial-chain certificate verification and OCSP response checking for the whole chain are enabled.
OpenSSL certificate verification X509_V_FLAG_PARTIAL_CHAIN + X509_V_FLAG_OCSP_RESP_CHECK_ALL = do not enable both together
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42765?
CVE-2026-42765 has a severity rating of high, with a score of 7.5 according to CVSS 3.1.
What causes the NULL dereference in CVE-2026-42765?
The NULL dereference in CVE-2026-42765 is caused by a failure to verify that the certificate chain includes a self-signed trusted anchor when OCSP checking is enabled.
How does CVE-2026-42765 impact the OpenSSL process?
CVE-2026-42765 causes the OpenSSL process to crash due to a NULL pointer dereference when the certificate chain does not contain the necessary trusted anchor.
How do I mitigate CVE-2026-42765?
To mitigate CVE-2026-42765, ensure that the certificate verification process includes a self-signed trusted anchor in the chain.
What software versions are affected by CVE-2026-42765?
CVE-2026-42765 affects OpenSSL implementations that support partial-chain certificate verification with OCSP response checking.