CVE-2026-42765

/// Technical description

Issue summary: When a partial-chain certificate verification is enabled

together with OCSP response checking for the whole chain, a NULL dereference

will happen if the verified chain does not have a self-signed trusted anchor,

crashing the process.

Impact summary: A NULL pointer dereference can trigger a crash which leads to a

Denial of Service for an application.

When performing OCSP response checking for certificates in the verification

chain, the code always tries to access the next certificate as the issuer.

There is a check for a self-signed certificate. However with the partial

chain verification enabled when the chain does not have a self-signed trusted

anchor, the issuer will be NULL for the last certificate in the chain. A NULL

pointer dereference then happens.

This issue affects only applications which enable both OCSP verification

of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial

chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate

verifi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References