cve-2026-42767

{
  "advisories": [
    {
      "id": "USN-8414-1",
      "source": "usn",
      "title": "OpenSSL vulnerabilities",
      "url": "https://ubuntu.com/security/notices/USN-8414-1"
    },
    {
      "id": "DSA-6335-1",
      "source": "dsa",
      "title": "openssl security update",
      "url": "https://lists.debian.org/debian-security-announce/2026/msg00245.html"
    },
    {
      "id": "DLA-4795-1",
      "source": "dla",
      "title": "openssl security update",
      "url": "https://lists.debian.org/debian-lts-announce/2026/09/msg00030.html"
    }
  ],
  "cve": "CVE-2026-42767",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[4.0.0,4.0.1)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[3.6.0,3.6.3)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[3.5.0,3.5.7)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[3.4.0,3.4.6)"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[3.0.0,3.0.21)"
            }
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "OpenSSL",
          "source": "cna",
          "vendor": "OpenSSL"
        },
        "product": "openssl",
        "vendor": "openssl"
      }
    ],
    "created": "2026-06-09T17:45:09.851612+00:00",
    "updated": "2026-06-09T23:00:15.719937+00:00",
    "vendors": [
      "openssl",
      "openssl$PRODUCT$openssl"
    ]
  },
  "epss": {
    "score": 0.00426
  },
  "mitre": {
    "cpes": [],
    "created": "2026-06-09T16:03:27.435000+00:00",
    "description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/42xxx/CVE-2026-42767.json",
    "references": [
      "https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046",
      "https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774",
      "https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f",
      "https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873",
      "https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d",
      "https://openssl-library.org/news/secadv/20260609.txt"
    ],
    "title": "NULL Pointer Dereference in CRMF EncryptedValue Decryption",
    "updated": "2026-06-10T07:48:03.405000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-476"
    ]
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
      "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"
    ],
    "created": "2026-06-09T17:17:08.093000+00:00",
    "description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 5.9,
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-42767.json",
    "references": [
      "https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046",
      "https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774",
      "https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f",
      "https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873",
      "https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d",
      "https://openssl-library.org/news/secadv/20260609.txt"
    ],
    "title": null,
    "updated": "2026-07-23T08:10:00.137000+00:00",
    "vendors": [
      "openssl",
      "openssl$PRODUCT$openssl"
    ],
    "weaknesses": [
      "CWE-476"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-06-09T16:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "NULL Pointer Dereference in CRMF EncryptedValue Decryption",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-476"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://github.com/openssl/security/commit/61a86a8cd73546c9fea916f3d304c1293e05c046",
                "https://github.com/openssl/security/commit/665d5254083affde9982efca7c41dd01cacc8774",
                "https://github.com/openssl/security/commit/810b722f772652ad48042bcc7ab07e3414b11d0f",
                "https://github.com/openssl/security/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873",
                "https://github.com/openssl/security/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d",
                "https://openssl-library.org/news/secadv/20260609.txt"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "d03cc267-4dd2-46d4-85ac-f708eddd0859"
      },
      {
        "created": "2026-06-09T18:00:00+00:00",
        "data": [
          {
            "details": [
              "openssl",
              "openssl$PRODUCT$openssl"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "openssl",
                "openssl$PRODUCT$openssl"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "478d9e20-b7f0-4122-b0d6-326a016c8fe1"
      },
      {
        "created": "2026-06-09T21:30:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 5.9,
                  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "none",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "d1195d99-ee79-4854-ae0c-23b14eefa5eb"
      },
      {
        "created": "2026-06-10T08:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046",
                "https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774",
                "https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f",
                "https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873",
                "https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "b5f78291-3e41-480e-9d18-f5ceded56fb2"
      },
      {
        "created": "2026-06-10T08:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [],
              "removed": [
                "https://github.com/openssl/security/commit/61a86a8cd73546c9fea916f3d304c1293e05c046",
                "https://github.com/openssl/security/commit/665d5254083affde9982efca7c41dd01cacc8774",
                "https://github.com/openssl/security/commit/810b722f772652ad48042bcc7ab07e3414b11d0f",
                "https://github.com/openssl/security/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873",
                "https://github.com/openssl/security/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d"
              ]
            },
            "type": "references"
          }
        ],
        "id": "b84a15ba-2db9-4d02-8ee6-ce24bc463e76"
      },
      {
        "created": "2026-06-11T00:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://nvd.nist.gov/vuln/detail/CVE-2026-42767",
                "https://www.cve.org/CVERecord?id=CVE-2026-42767"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {},
              "removed": {},
              "updated": {
                "threat_severity": {
                  "new": "Low",
                  "old": null
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "b69afd75-6142-444e-bce7-704e57599090"
      },
      {
        "created": "2026-06-16T06:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          }
        ],
        "id": "89e9de43-ce8d-4a51-85a1-8f4e4b707635"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2026-06-09T00:00:00+00:00",
      "provider": "redhat"
    },
    "description": {
      "data": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 5.9,
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        "provider": "vulnrichment"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00426
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "none",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": "Low",
        "provider": "redhat"
      }
    },
    "references": {
      "data": [
        "https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046",
        "https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774",
        "https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f",
        "https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873",
        "https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-42767",
        "https://openssl-library.org/news/secadv/20260609.txt",
        "https://www.cve.org/CVERecord?id=CVE-2026-42767"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    },
    "title": {
      "data": "NULL Pointer Dereference in CRMF EncryptedValue Decryption",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-06-16T02:58:39.020000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "openssl",
        "openssl$PRODUCT$openssl"
      ],
      "providers": [
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-476"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    }
  },
  "redhat": {
    "cpes": [],
    "created": "2026-06-09T00:00:00+00:00",
    "description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\nApplications that process untrusted CMP/CRMF messages may be affected.\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 5.3,
        "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
      },
      "threat_severity": "Low"
    },
    "redhat_repo_path": "2026/CVE-2026-42767.json",
    "references": [
      "https://nvd.nist.gov/vuln/detail/CVE-2026-42767",
      "https://www.cve.org/CVERecord?id=CVE-2026-42767"
    ],
    "title": "openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption",
    "updated": "2026-06-09T00:00:00+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-476"
    ]
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-06-09T16:03:27.435000+00:00",
    "description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 5.9,
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
      },
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "none",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "NULL Pointer Dereference in CRMF EncryptedValue Decryption",
    "updated": "2026-06-09T19:41:44.227000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/42xxx/CVE-2026-42767.json",
    "weaknesses": []
  }
}