Skip to main content

OpenSSL EUVDEUVD-2026-89010

| CVE-2026-75805 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-09-29 GHSA-gpg3-m652-f2vc
Denial Of Service Null Pointer Dereference OpenSSL
5.3
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Position as/MITM CMP server
  2. Delivery
    Client sends revocation request
  3. Exploit
    Return crafted revocation response
  4. Execution
    NULL pointer dereference in client
  5. Impact
    Client process crashes (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The affected application must use OpenSSL as a CMP (Certificate Management Protocol) client and process a certificate revocation response, and that response must come from a malicious or man-in-the-middle CMP server. This is a narrow, non-default feature - the overwhelming majority of OpenSSL deployments use it for TLS and never invoke the CMP client code path, so exposure is far smaller than OpenSSL's ubiquity suggests. Impact is limited to a crash (availability) of the client process; there is no confidentiality or integrity impact and no code execution.
Impact

This is a genuine but low-priority DoS. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L = 5.3) is internally consistent with the description: a NULL pointer dereference (CWE-476) in CMP client revocation-response handling yields availability-only impact (A:L, no confidentiality or integrity), and my independent assessment agrees with it. Signals align rather than conflict: CISA SSVC records Exploitation=none (no observed exploitation) with Automatable=yes and Technical Impact=partial, which is coherent for a crash-class client bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The one caveat is direction of attack: although PR:N/AV:N reads as classic remote-unauthenticated, this bug triggers only when an application is acting as an OpenSSL CMP client and receives a malicious revocation response - effectively requiring a malicious or MITM'd CMP server rather than the attacker connecting inbound. This narrow trigger, combined with availability-only impact, keeps real-world priority low despite OpenSSL's ubiquity. It is one of many fixes in the OpenSSL 4.0.3 batch and is not the most severe (a High-rated DTLS bug, CVE-2026-84782, leads that release).
Exploit ScenarioDerived

An application using OpenSSL's CMP (Certificate Management Protocol) client initiates a certificate revocation request to a CMP server that is attacker-controlled or intercepted via MITM. The server returns a crafted revocation response that triggers a NULL pointer dereference in the client's response-handling code, crashing the client process. No public exploit code was identified at time of analysis; impact is limited to denial of service of the client.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

A NULL pointer dereference in OpenSSL's CMP (Certificate Management Protocol) client revocation-response handling lets a malicious or man-in-the-middle CMP server crash the client process, handing remote attackers a denial-of-service primitive against applications that actually exercise the CMP client code path. Affected branches are OpenSSL 3.0.0 through 3.0.22, 3.4.0 through 3.4.7, 3.5.0 through 3.5.8, 3.6.0 through 3.6.4, and 4.0.0 through 4.0.2, with the fix shipping in the OpenSSL 4.0.3 security release. Per the CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) it is a remote, unauthenticated-in-vector availability issue only - no confidentiality, integrity, or code-execution impact - and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial; no KEV listing).

RemediationAI

Vendor-released patch: upgrade to OpenSSL 4.0.3 (the 4.0 branch fix) for the 4.0.x line; the older branches are closed by the maintenance releases that terminate the EUVD ranges - 3.6.5, 3.5.9, 3.4.8, and 3.0.23 - so 3.x consumers should move to whichever of those applies to their branch, then rebuild and redeploy any statically linked or vendored copies, container base images, and packaged runtimes. The authoritative reference is the OpenSSL security advisory at https://openssl-library.org/news/secadv/20260929.txt and the release page at https://github.com/openssl/openssl/releases/tag/openssl-4.0.3. If an immediate upgrade is not feasible, the highest-value compensating control is to stop exercising the vulnerable path: disable CMP client revocation-status checking (for example the OSSL_CMP_CTX revocation-check options / rpkiCheck flow) in any application that does not strictly require it, accepting the trade-off that CMP-based revocation assurance is lost until patched. Where CMP must stay enabled, constrain who can answer it - pin or hard-allowlist the trusted CMP server certificate/endpoint, require mutual TLS, and restrict outbound access to the legitimate CMP responder so a man-in-the-middle position cannot deliver the malformed response - noting that this reduces but does not fully eliminate exposure if the trusted server itself is compromised. Finally, wrap or supervise the CMP client process so an abort is restarted rather than left down, since the impact here is availability only (SSVC Technical Impact: partial).

Affected VersionsENISA

OpenSSL 3.6.0 <3.6.5
OpenSSL 3.5.0 <3.5.9
OpenSSL 4.0.0 <4.0.3
OpenSSL 3.0.0 <3.0.23
OpenSSL 3.4.0 <3.4.8

Affected Packages

euvd openssl fix: 3.0.23, 3.4.8, 3.5.9, 3.6.5, 4.0.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The root cause is a NULL pointer dereference (CWE-476) reached through OpenSSL's CMP client implementation, the library code that speaks RFC 4210 Certificate Management Protocol to a CMP/EST-style enrollment or revocation server. When the client processes a certificate revocation response (for example an rpkiCheck / revocation-status exchange) returned by the CMP peer, the parsing and cache-handling logic can dereference a pointer that was never initialised - most plausibly when the response is malformed, truncated, or omits an expected field - and the process aborts. CMP is a top-level library API (OSSL_CMP_*) and is not part of the default TLS handshake; it is reached only by applications that explicitly act as CMP clients, which is why the practical attack surface is far narrower than OpenSSL's install base implies. The issue was reported and fixed as one of a dozen-plus hardening items bundled into the same upstream release cycle (alongside DTLS retransmission, X.509 extension cache use-after-free, QUIC flow-control and fragment-reassembly DoS, CRLDP allocation, and several constant-time/side-channel fixes), which is consistent with a coordinated security patch release rather than an emergency out-of-band fix.

Know when OpenSSL gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI 5.3 MEDIUM

Client-side NULL deref reachable over the network from a malicious CMP server with no auth or user interaction, causing only a crash, so A:L and C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.9 MEDIUM

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
CVSS changed
Sep 29, 2026 - 17:22 NVD
5.3 (MEDIUM)
CVE Published
Sep 29, 2026 - 13:53 github-releases
MEDIUM 5.3
CVE Published
Sep 29, 2026 - 13:53 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openssl/openssl. NVD scoring and full description are pending.

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Prevalence
Ubiquitous
OpenSSL is the dominant crypto/TLS library across nearly all environments
Data Quality
8 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2021-3711 CRITICAL POC
9.8 Aug 24

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2022-2068 HIGH
7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container bci/bci-sle15-kernel-module-devel:15.7-61.25 Container bci/openjdk-devel:17.0.20.1-21.71 Container bci/openjdk-devel:21.0.12.1-25.71 Container bci/openjdk-devel:25.0.4.1-9.72 Container bci/openjdk:17.0.20.1-20.61 Container bci/openjdk:21.0.12.1-24.60 Container bci/openjdk:25.0.4.1-9.60 Container bci/python:3.13.15-88.58 Container bci/python:3.6.15-84.56 Container suse/sle15:15.7-5.23.43 Affected
Container private-registry/1.2/harbor-core:1.2.1-1.115 Container private-registry/1.2/harbor-exporter:1.2.1-1.115 Container private-registry/1.2/harbor-jobservice:1.2.1-1.113 Container private-registry/1.2/harbor-registry:1.2.1-1.115 Container private-registry/1.2/harbor-registryctl:1.2.1-1.115 Container private-registry/1.2/harbor-trivy-adapter:1.2.1-1.124 Container private-registry/harbor-core:latest Container private-registry/harbor-exporter:latest Container private-registry/harbor-jobservice:latest Container private-registry/harbor-registry:2.8.3-1.85 Container private-registry/harbor-registryctl:latest Container private-registry/harbor-trivy-adapter:0.35.1-1.87 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.177 Container suse/kiosk/tigervnc-x11vnc:1.14-63.43 Container suse/mariadb:11.8.8-79.42 Image pr_15_7_1_0 Affected
Container private-registry/1.2/harbor-portal:1.2.1-1.124 Container private-registry/harbor-portal:latest Container suse/kea:2.6-80.9 Container suse/kiosk/firefox-esr:153.3-75.45 Container suse/kiosk/pulseaudio:17.0-73.42 Container suse/kiosk/xorg-client:21-81.7 Container suse/kiosk/xorg:21.1-83.42 Container suse/mariadb-client:11.8.8-72.32 Container suse/postgres:16.15-93.41 Container suse/postgres:16.15-contrib-93.41 Container suse/postgres:17.11-83.40 Container suse/postgres:17.11-contrib-83.40 Container suse/postgres:18.6-73.40 Container suse/rmt-server:3.1-72.2 Container suse/samba-client:4.21-75.34 Container suse/samba-server:4.21-76.36 Container suse/samba-toolbox:4.21-76.34 Container third-party/amd/amdgpu-driver:sles-15.7-30.20.1 Container third-party/amd/amdgpu-driver:sles-15.7-30.30.4 Container third-party/amd/amdgpu-driver:sles-15.7-31.10 Container third-party/amd/amdgpu-driver:sles-15.7-31.20 Container third-party/amd/amdgpu-driver:sles-15.7-31.30 Container third-party/amd/amdgpu-driver:sles-15.7-31.40.1 Container third-party/amd/amdgpu-driver:sles-15.7-31.50 Container third-party/nvidia/driver:550-sles15.7 Container third-party/nvidia/driver:570-sles15.7 Container third-party/nvidia/driver:575-sles15.7 Container third-party/nvidia/driver:580-sles15.7 Container third-party/nvidia/driver:590-sles15.7 Container third-party/nvidia/driver:595-sles15.7 Container third-party/nvidia/driver:610-sles15.7 Container third-party/nvidia/driver:615-sles15.7 Affected
Container suse/ltss/sle15.5/sle15:15.5-8.73 Affected
Container suse/ltss/sle15.6/bci-base-fips:15.6-35.106 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:74162 ADVISORY https://access.redhat.com/errata/RHSA-2026:74166 ADVISORY https://github.com/openssl/openssl/releases/tag/openssl-4.0.3 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-75805 ADVISORY https://seclists.org/oss-sec/2026/q3/1001 ADVISORY https://ubuntu.com/security/notices/USN-8847-1 ADVISORY https://vuldb.com/vuln/411438 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4412/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4413/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4414/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4419/ REF https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166 REF https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7 REF https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3 REF https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f REF https://openssl-library.org/news/secadv/20260929.txt

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy