CVE-2026-14457
Fixed in a distro release EPSS 1%CVSS 7.5
Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.
Products: OpenSSL
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | openssl | 1:3.5.8-1.el10_2.alma.1 |
| AlmaLinux 10 | openssl-devel | 1:3.5.8-1.el10_2.alma.1 |
| AlmaLinux 10 | openssl-libs | 1:3.5.8-1.el10_2.alma.1 |
| AlmaLinux 10 | openssl-perl | 1:3.5.8-1.el10_2.alma.1 |
| AlmaLinux 9 | openssl | 1:3.5.8-1.el9_8 |
| AlmaLinux 9 | openssl-devel | 1:3.5.8-1.el9_8 |
| AlmaLinux 9 | openssl-libs | 1:3.5.8-1.el9_8 |
| AlmaLinux 9 | openssl-perl | 1:3.5.8-1.el9_8 |
| Alpine 3.22 | openssl | 3.5.8-r0 |
| Alpine 3.23 | openssl | 3.5.8-r0 |
| Alpine 3.24 | openssl | 3.5.8-r0 |
| Chainguard | eco-python-openssl-4 | 4.0.2-r0 |
| Chainguard | eco-python-openssl-4-pyca | 4.0.2-r0 |
| Chainguard | eco-python-openssl-4-pyca-dev | 4.0.2-r0 |
| Chainguard | openssl-provider-fips-3.4.0 | 0 |
| Chainguard | openssl-provider-fips-3.4.0-dbg | 0 |
| Chainguard | openssl-provider-fips-3.6.0 | 0 |
| Chainguard | openssl-provider-fips-3.6.0-dbg | 0 |
| Debian 13 | openssl | 3.5.7-1~deb13u2 |
| Debian 14 | openssl | 3.6.4-1 |
| Red Hat Enterprise Linux 10.2 | openssl | 1:3.5.8-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-debuginfo | 1:3.5.8-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-debugsource | 1:3.5.8-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-devel | 1:3.5.8-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-libs | 1:3.5.8-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-libs-debuginfo | 1:3.5.8-1.el10_2 |
| Red Hat Enterprise Linux 10.2 | openssl-perl | 1:3.5.8-1.el10_2 |
| Red Hat Enterprise Linux 9 | openssl | 1:3.5.8-1.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-debuginfo | 1:3.5.8-1.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-debugsource | 1:3.5.8-1.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-devel | 1:3.5.8-1.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-libs | 1:3.5.8-1.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-libs-debuginfo | 1:3.5.8-1.el9_8 |
| Red Hat Enterprise Linux 9 | openssl-perl | 1:3.5.8-1.el9_8 |
| Red Hat hummingbird 1 | openssl | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-config-fips | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-devel | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-devel-engine | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-fips-provider-upstream | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-libs | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl-perl | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3 | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3-devel | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3-devel-engine | 0:3.5.8-0.1.hum1 |
| Red Hat hummingbird 1 | openssl3-libs | 0:3.5.8-0.1.hum1 |
| Rocky Linux 10 | openssl | 1:3.5.8-1.el10_2 |
| Rocky Linux 9 | openssl | 1:3.5.8-1.el9_8 |
| SUSE Linux Enterprise Live Patching 15 SP6 | openssl-3-livepatches | 0.6-150600.13.19.1 |
| SUSE Linux Enterprise Live Patching 15 SP7 | openssl-3-livepatches | 0.6-150700.16.12.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | openssl-3 | 3.5.0-150700.5.50.1 |
| SUSE Linux Enterprise Server 16.0 | openssl-3 | 3.5.0-160000.10.1 |
| SUSE Linux Enterprise Server 16.0 | openssl-3-livepatches | 0.6-160000.1.1 |
| SUSE Linux Enterprise Server 16.0 | openssl-3-x86_64-v3-livepatches | 0.6-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | openssl-3 | 3.5.0-160000.10.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | openssl-3-livepatches | 0.6-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | openssl-3-x86_64-v3-livepatches | 0.6-160000.1.1 |
| SUSE Linux Micro 6.1 | openssl-3-livepatches | 0.6-slfo.1.1_1.1 |
| SUSE Linux Micro 6.2 | openssl-3 | 3.5.0-160000.10.1 |
| SUSE Linux Micro 6.2 | openssl-3-livepatches | 0.6-160000.1.1 |
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.29 |
| Ubuntu 24.04 LTS | openssl | 3.0.13-0ubuntu3.15 |
| Ubuntu 26.04 LTS | edk2 | no fix |
| Ubuntu 26.04 LTS | edk2-hwe | no fix |
| Ubuntu 26.04 LTS | openssl | 3.5.5-1ubuntu3.4 |
| Ubuntu 26.10 | edk2 | no fix |
| Ubuntu 26.10 | edk2-hwe | no fix |
| Ubuntu Pro 16.04 LTS | nodejs | no fix |
| Ubuntu Pro 18.04 LTS | nodejs | no fix |
| openSUSE Leap 16.0 | openssl-3 | 3.5.0-160000.10.1 |
| openSUSE Tumbleweed | openssl-3 | 3.5.3-8.1 |