CVE-2026-14457

/// Technical description

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)

enabled, and only the private key (with no associated certificate) configured locally,

a NULL pointer dereference may occur when the remote peer solicits raw public keys and

also sends the typically omitted "signature_algorithms_cert" TLS extension.

Impact summary: The impact is limited to a possible Denial of Service as a result of

an application abort, no data disclosure or remote command execution are possible.

CWE: CWE-476: NULL Pointer Dereference

Description: While a passing comment in sample code in the documentation suggests

that key-only RPK configurations are supported, the best-practice RPK configuration

is to always configure a corresponding certificate (possibly self-signed or

signed by any convenient CA).

When the private key is configured along with a matching certificate, the

"signature_algorithms_cert" extension is handled reliably even without the

fix, and peer clients or server

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References