EUVD-2026-65479
GHSA-6m2h-7hrp-6jw8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Once a key-only RPK endpoint is found, triggering the crash requires only sending a standard extension with no special timing or privileges, justifying AC:L and PR:N; impact is availability-only (process abort).
Primary rating from Vendor (openssl).
CVSS VectorVendor: openssl
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionCVE.org
Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension.
Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible.
CWE: CWE-476: NULL Pointer Dereference
Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA).
When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key.
Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below.
FIPS impact: no
No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.
Articles & Coverage 1
AnalysisAI
NULL pointer dereference in OpenSSL's RFC7250 Raw Public Key (RPK) TLS extension handling crashes any server or client configured in key-only RPK mode when a remote peer sends the typically omitted signature_algorithms_cert extension. Affected versions span OpenSSL 3.4.x through 4.0.x; impact is strictly limited to a process-aborting Denial of Service - no data disclosure or code execution is possible. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the targeted endpoint be explicitly configured for RFC7250 Raw Public Key mode with only a private key loaded and no accompanying certificate - this is a non-default configuration that must be deliberately enabled by an operator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects that no authentication is required and the attack is network-accessible, but substantially overstates practical risk for most environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote unauthenticated attacker who identifies an OpenSSL TLS endpoint operating in key-only RPK mode sends a ClientHello (TLS 1.2/1.3) or a TLS 1.3 CertificateRequest containing the `signature_algorithms_cert` extension - an extension that OpenSSL itself does not emit by default and most implementations omit. When OpenSSL's `check_cert_usable()` processes this extension against the key-only credential slot, it dereferences the NULL certificate pointer and the application aborts. … |
| Remediation | Upgrade to the earliest fixed release applicable to your deployment: OpenSSL 3.4.7, 3.5.8, 3.6.4, or 4.0.2, per the vendor advisory at https://openssl-library.org/news/secadv/20260825.txt. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running OpenSSL 3.4.x through 4.0.x and identify those deployed in Raw Public Key (RPK) mode, prioritizing production endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today