CVE-2026-42767
Fixed in a distro release EPSS <1%CVSS 5.9
Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Products: OpenSSL
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:10 | openssl | 1:3.5.5-4.el10_2.alma.1 |
| AlmaLinux:10 | openssl-devel | 1:3.5.5-4.el10_2.alma.1 |
| AlmaLinux:10 | openssl-libs | 1:3.5.5-4.el10_2.alma.1 |
| AlmaLinux:10 | openssl-perl | 1:3.5.5-4.el10_2.alma.1 |
| AlmaLinux:9 | openssl | 1:3.5.5-4.el9_8 |
| AlmaLinux:9 | openssl-devel | 1:3.5.5-4.el9_8 |
| AlmaLinux:9 | openssl-libs | 1:3.5.5-4.el9_8 |
| AlmaLinux:9 | openssl-perl | 1:3.5.5-4.el9_8 |
| Alpine:v3.22 | openssl | 3.5.7-r0 |
| Alpine:v3.23 | openssl | 3.5.7-r0 |
| Alpine:v3.24 | openssl | 3.5.7-r0 |
| Chainguard | libcrypto3 | 3.6.3-r0 |
| Chainguard | libcrypto3-2.34 | 3.6.3-r0 |
| Chainguard | openssl | 3.6.3-r0 |
| Chainguard | openssl-provider-fips-3.4.0 | 0 |
| Chainguard | openssl-provider-fips-3.4.0-dbg | 0 |
| Chainguard | openssl-provider-fips-3.6.0 | 0 |
| Chainguard | openssl-provider-fips-3.6.0-dbg | 0 |
| Debian:12 | openssl | 3.0.22-1~deb12u1 |
| Debian:13 | openssl | 3.5.6-1~deb13u2 |
| Debian:14 | openssl | 3.6.3-1 |
| Red Hat:enterprise_linux:10.2 | openssl | 1:3.5.5-4.el10_2 |
| Red Hat:enterprise_linux:10.2 | openssl-debuginfo | 1:3.5.5-4.el10_2 |
| Red Hat:enterprise_linux:10.2 | openssl-debugsource | 1:3.5.5-4.el10_2 |
| Red Hat:enterprise_linux:10.2 | openssl-devel | 1:3.5.5-4.el10_2 |
| Red Hat:enterprise_linux:10.2 | openssl-libs | 1:3.5.5-4.el10_2 |
| Red Hat:enterprise_linux:10.2 | openssl-libs-debuginfo | 1:3.5.5-4.el10_2 |
| Red Hat:enterprise_linux:10.2 | openssl-perl | 1:3.5.5-4.el10_2 |
| Red Hat:enterprise_linux:9 | openssl | 1:3.5.5-4.el9_8 |
| Red Hat:enterprise_linux:9 | openssl-debuginfo | 1:3.5.5-4.el9_8 |
| Red Hat:enterprise_linux:9 | openssl-debugsource | 1:3.5.5-4.el9_8 |
| Red Hat:enterprise_linux:9 | openssl-devel | 1:3.5.5-4.el9_8 |
| Red Hat:enterprise_linux:9 | openssl-libs | 1:3.5.5-4.el9_8 |
| Red Hat:enterprise_linux:9 | openssl-libs-debuginfo | 1:3.5.5-4.el9_8 |
| Red Hat:enterprise_linux:9 | openssl-perl | 1:3.5.5-4.el9_8 |
| Red Hat:hummingbird:1 | bootupd | 0:0.3.2-1.hum1 |
| Red Hat:hummingbird:1 | chunkah | 0:0.6.0-3.hum1 |
| Red Hat:hummingbird:1 | openssl | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-config-fips | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-devel | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-devel-engine | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-fips-provider-upstream | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-libs | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl-perl | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl3 | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl3-devel | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl3-devel-engine | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | openssl3-libs | 0:3.5.8-0.1.hum1 |
| Red Hat:hummingbird:1 | python-cryptography | 0:50.0.0-1.hum1 |
| Red Hat:hummingbird:1 | python3-cryptography | 0:50.0.0-1.hum1 |
| Red Hat:hummingbird:1 | ruby3.3 | 0:3.3.10-23.6.hum1 |
| Red Hat:hummingbird:1 | ruby3.3-bundled-gems | 0:3.3.10-23.6.hum1 |
| Red Hat:hummingbird:1 | ruby3.3-default-gems | 0:3.3.10-23.6.hum1 |
| Red Hat:hummingbird:1 | ruby3.3-devel | 0:3.3.10-23.6.hum1 |
| Red Hat:hummingbird:1 | ruby3.3-doc | 0:3.3.10-23.6.hum1 |
| Red Hat:hummingbird:1 | ruby3.3-libs | 0:3.3.10-23.6.hum1 |
| Red Hat:hummingbird:1 | ruby3.4 | 0:3.4.10-31.7.hum1 |
| Red Hat:hummingbird:1 | ruby3.4-bundled-gems | 0:3.4.10-31.7.hum1 |
| Red Hat:hummingbird:1 | ruby3.4-default-gems | 0:3.4.10-31.7.hum1 |
| Red Hat:hummingbird:1 | ruby3.4-devel | 0:3.4.10-31.7.hum1 |
| Red Hat:hummingbird:1 | ruby3.4-doc | 0:3.4.10-31.7.hum1 |
| Red Hat:hummingbird:1 | ruby3.4-libs | 0:3.4.10-31.7.hum1 |
| Red Hat:hummingbird:1 | ruby4.0 | 0:4.0.6-37.3.hum1 |
| Red Hat:hummingbird:1 | ruby4.0-bundled-gems | 0:4.0.6-37.3.hum1 |
| Red Hat:hummingbird:1 | ruby4.0-default-gems | 0:4.0.6-37.3.hum1 |
| Red Hat:hummingbird:1 | ruby4.0-devel | 0:4.0.6-37.3.hum1 |
| Red Hat:hummingbird:1 | ruby4.0-doc | 0:4.0.6-37.3.hum1 |
| Red Hat:hummingbird:1 | ruby4.0-libs | 0:4.0.6-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-bigdecimal | 0:3.1.5-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-bundler | 0:2.5.22-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-devel | 0:3.5.22-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-io-console | 0:0.7.1-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-irb | 0:1.13.1-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-json | 0:2.7.2-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-minitest | 0:5.20.0-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-power_assert | 0:2.0.3-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-psych | 0:5.1.2-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-racc | 0:1.7.3-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-rake | 0:13.1.0-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-rbs | 0:3.4.0-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-rdoc | 0:6.6.3.1-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-rexml | 0:3.4.4-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-rss | 0:0.3.1-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-rubygems | 0:3.5.22-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-test-unit | 0:3.6.1-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem3.3-typeprof | 0:0.21.9-23.6.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-bigdecimal | 0:4.0.1-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-bundler | 0:4.0.16-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-devel | 0:4.0.16-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-io-console | 0:0.8.2-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-irb | 0:1.16.0-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-json | 0:2.18.0-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-minitest | 0:6.0.0-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-power_assert | 0:3.0.1-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-psych | 0:5.3.1-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-racc | 0:1.8.1-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-rake | 0:13.3.1-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-rbs | 0:3.10.0-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-rdoc | 0:7.0.4-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-rexml | 0:3.4.4-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-rss | 0:0.3.2-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-rubygems | 0:4.0.16-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-test-unit | 0:3.7.5-37.3.hum1 |
| Red Hat:hummingbird:1 | rubygem4.0-typeprof | 0:0.31.1-37.3.hum1 |
| Red Hat:hummingbird:1 | rust-bootupd | 0:0.3.2-1.hum1 |
| Rocky Linux:10 | openssl | 1:3.5.5-4.el10_2 |
| Rocky Linux:9 | openssl | 1:3.5.5-4.el9_8 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | openssl-3 | 3.0.8-150400.4.90.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | openssl-3 | 3.0.8-150400.4.90.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | openssl-3 | 3.0.8-150500.5.69.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | openssl-3 | 3.0.8-150500.5.69.1 |
| SUSE:Linux Enterprise Micro 5.3 | openssl-3 | 3.0.8-150400.4.90.1 |
| SUSE:Linux Enterprise Micro 5.4 | openssl-3 | 3.0.8-150400.4.90.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | openssl-3 | 3.2.3-150700.5.36.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | openssl-3 | 3.0.8-150400.4.90.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | openssl-3 | 3.0.8-150500.5.69.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openssl-3 | 3.1.4-150600.5.56.1 |
| SUSE:Linux Enterprise Server 16.0 | openssl-3 | 3.5.0-160000.8.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | openssl-3 | 3.0.8-150400.4.90.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | openssl-3 | 3.0.8-150500.5.69.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openssl-3 | 3.1.4-150600.5.56.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | openssl-3 | 3.5.0-160000.8.1 |
| SUSE:Linux Micro 6.0 | openssl-3 | 3.1.4-15.1 |
| SUSE:Linux Micro 6.1 | openssl-3 | 3.1.4-slfo.1.1_11.1 |
| SUSE:Linux Micro 6.2 | openssl-3 | 3.5.0-160000.8.1 |
| Ubuntu:22.04:LTS | openssl | 3.0.2-0ubuntu1.25 |
| Ubuntu:24.04:LTS | edk2 | no fix |
| Ubuntu:24.04:LTS | openssl | 3.0.13-0ubuntu3.11 |
| Ubuntu:25.10 | edk2 | no fix |
| Ubuntu:25.10 | openssl | 3.5.3-1ubuntu3.4 |
| Ubuntu:26.04:LTS | edk2 | no fix |
| Ubuntu:26.04:LTS | edk2-hwe | no fix |
| Ubuntu:26.04:LTS | openssl | 3.5.5-1ubuntu3.2 |
| Ubuntu:26.10 | edk2 | no fix |
| Ubuntu:26.10 | edk2-hwe | no fix |
| Ubuntu:Pro:22.04:LTS | nodejs | no fix |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | openssl | no fix |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | openssl-fips | no fix |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | openssl | 3.0.2-0ubuntu1.25+Fips1 |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | openssl-fips | no fix |
| Ubuntu:Pro:FIPS-updates:24.04:LTS | openssl-fips | 3.0.13-0ubuntu3.12+Fips1 |
| Wolfi | libcrypto3 | 3.6.3-r0 |
| Wolfi | openssl | 3.6.3-r0 |
| openSUSE:Leap 16.0 | openssl-3 | 3.5.0-160000.8.1 |
| openSUSE:Tumbleweed | openssl-3 | 3.5.3-6.1 |