Skip to main content

OpenSSL EUVDEUVD-2026-35484

| CVE-2026-42767 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-09 GHSA-gxhg-7jx8-m22j
Denial Of Service Null Pointer Dereference OpenSSL
5.9
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.3 LOW
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jun 09, 2026 - 21:37 vuln.today
Analysis Generated
Jun 09, 2026 - 21:37 vuln.today
CVSS changed
Jun 09, 2026 - 21:22 NVD
5.9 (MEDIUM)
CVE Published
Jun 09, 2026 - 11:43 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 09, 2026 - 11:43 nvd
MEDIUM 5.9

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

AnalysisAI

NULL pointer dereference in OpenSSL's CRMF EncryptedValue decryption path crashes the affected process, creating a remotely triggerable denial-of-service condition across five actively maintained OpenSSL branches (3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.x). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.9) confirms network reachability with no authentication required, but high attack complexity limits trivial mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the broad version coverage and OpenSSL's ubiquitous deployment make patching a priority for any infrastructure using certificate management protocols.

Technical ContextAI

Certificate Request Message Format (CRMF, RFC 4211) is a protocol used in PKI workflows - notably with CMP (Certificate Management Protocol) - for enrolling and renewing certificates. The EncryptedValue structure within CRMF carries encrypted key material during these exchanges. CWE-476 (NULL Pointer Dereference) indicates that the OpenSSL decryption code path for EncryptedValue fails to validate a pointer before dereferencing it, likely when a required field is absent or malformed in a crafted CRMF message. The root cause sits in OpenSSL's CRMF implementation rather than in a broadly used primitive (e.g., TLS handshake), which limits the attack surface to applications and services that explicitly invoke CRMF/CMP certificate management operations using the affected OpenSSL library. Commit references on the openssl/security GitHub repository (commits 61a86a8c, 665d5254, 810b722f, b90ff3b1, e6f91290) have been linked by NVD, and the official advisory is published at openssl-library.org/news/secadv/20260609.txt.

RemediationAI

The primary remediation is to upgrade to the patched OpenSSL releases: 3.0.21, 3.4.6, 3.5.7, 3.6.3, or 4.0.1 depending on the branch in use. These are vendor-released security patch versions confirmed by the OpenSSL 4.0.1 release notes and the EUVD record. The official security advisory at https://openssl-library.org/news/secadv/20260609.txt should be consulted for branch-specific guidance. Ubuntu users should apply USN-8414-2 (https://ubuntu.com/security/notices/USN-8414-2) via the standard package manager. As a compensating control where immediate patching is not feasible, administrators should restrict access to any service or daemon that processes CRMF or CMP messages - specifically CA enrollment endpoints and SCEP/CMP gateways - to trusted internal networks or authenticated management VLANs. This reduces the network-reachable attack surface at the cost of limiting external certificate enrollment workflows. Disabling CRMF/CMP functionality entirely is an option for deployments that do not use those protocols, but this requires application-level configuration changes that vary by software stack.

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2017-3730 HIGH POC
7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

CVE-2016-8610 HIGH
7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed

Share

EUVD-2026-35484 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy