CVE-2026-42765

Issue summary: When a partial-chain certificate verification is enabled<br /> together with OCSP response checking for the whole chain, a NULL dereference<br /> will happen if the verified chain does not have a self-signed trusted anchor,<br /> crashing the process.<br /> <br /> Impact summary: A NULL pointer dereference can trigger a crash which leads to a<br /> Denial of Service for an application.<br /> <br /> When performing OCSP response checking for certificates in the verification<br /> chain, the code always tries to access the next certificate as the issuer.<br /> There is a check for a self-signed certificate. However with the partial<br /> chain verification enabled when the chain does not have a self-signed trusted<br /> anchor, the issuer will be NULL for the last certificate in the chain. A NULL<br /> pointer dereference then happens.<br /> <br /> This issue affects only applications which enable both OCSP verification<br /> of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial<br /> chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate<br /> verification. Both flags are disabled by default. For that reason, we have<br /> assigned Low severity to the issue.<br /> <br /> No FIPS modules are affected by this issue as the affected code is outside<br /> the OpenSSL FIPS module boundary.