DEBIAN-CVE-2026-42767
Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. Applications that process untrusted CMP/CRMF messages may be affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
DEBIAN-CVE-2026-42767
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-42767
openssl
Source reference: /affected/0/package/name
- Affected versions
- 3.0.10-1
Source reference:
/affected/0/versions3.0.10-1~deb12u1Source reference:
/affected/0/versions3.0.11-1Source reference:
/affected/0/versions3.0.11-1~deb12u1Source reference:
/affected/0/versions3.0.11-1~deb12u2Source reference:
/affected/0/versions3.0.12-1Source reference:
/affected/0/versions3.0.12-2Source reference:
/affected/0/versions3.0.13-1~deb12u1Source reference:
/affected/0/versions3.0.13-1~deb12u2Source reference:
/affected/0/versions3.0.14-1~deb12u1Source reference:
/affected/0/versions3.0.14-1~deb12u2Source reference:
/affected/0/versions3.0.15-1~deb12u1Source reference:
/affected/0/versions3.0.16-1~deb12u1Source reference:
/affected/0/versions3.0.17-1~deb12u1Source reference:
/affected/0/versions3.0.17-1~deb12u2Source reference:
/affected/0/versions3.0.17-1~deb12u3Source reference:
/affected/0/versions3.0.18-1~deb12u1Source reference:
/affected/0/versions3.0.18-1~deb12u2Source reference:
/affected/0/versions3.0.19-1~deb12u1Source reference:
/affected/0/versions3.0.19-1~deb12u2Source reference:
/affected/0/versions3.0.20-1~deb12u1Source reference:
/affected/0/versions3.0.20-1~deb12u2Source reference:
/affected/0/versions3.0.9-1Source reference:
/affected/0/versions - Fixed versions
- 3.0.22-1~deb12u1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
openssl
Source reference: /affected/1/package/name
- Affected versions
- 3.5.1-1
Source reference:
/affected/1/versions3.5.1-1+deb13u1Source reference:
/affected/1/versions3.5.2-1Source reference:
/affected/1/versions3.5.3-1Source reference:
/affected/1/versions3.5.4-1Source reference:
/affected/1/versions3.5.4-1~deb13u1Source reference:
/affected/1/versions3.5.4-1~deb13u2Source reference:
/affected/1/versions3.5.5-1Source reference:
/affected/1/versions3.5.5-1~deb13u1Source reference:
/affected/1/versions3.5.5-1~deb13u2Source reference:
/affected/1/versions3.5.6-1~deb13u1Source reference:
/affected/1/versions - Fixed versions
- 3.5.6-1~deb13u2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
openssl
Source reference: /affected/2/package/name
- Affected versions
- 3.5.1-1
Source reference:
/affected/2/versions3.5.2-1Source reference:
/affected/2/versions3.5.3-1Source reference:
/affected/2/versions3.5.4-1Source reference:
/affected/2/versions3.5.4-1~deb13u1Source reference:
/affected/2/versions3.5.4-1~deb13u2Source reference:
/affected/2/versions3.5.5-1Source reference:
/affected/2/versions3.5.5-1~deb13u1Source reference:
/affected/2/versions3.5.5-1~deb13u2Source reference:
/affected/2/versions3.5.6-1~deb13u1Source reference:
/affected/2/versions3.5.6-1~deb13u2Source reference:
/affected/2/versions3.5.7-1~deb13u1Source reference:
/affected/2/versions3.5.7-1~deb13u2Source reference:
/affected/2/versions3.5.7-1~deb13u3Source reference:
/affected/2/versions3.6.0-1Source reference:
/affected/2/versions3.6.0-2Source reference:
/affected/2/versions3.6.0~~alpha1-1Source reference:
/affected/2/versions3.6.0~~beta1-1Source reference:
/affected/2/versions3.6.1-1Source reference:
/affected/2/versions3.6.1-2Source reference:
/affected/2/versions3.6.1-3Source reference:
/affected/2/versions3.6.2-1Source reference:
/affected/2/versions - Fixed versions
- 3.6.3-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.22-1~deb12u1"
}
]
}
],
"package": {
"name": "openssl",
"purl": "pkg:deb/debian/openssl?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.0.10-1",
"3.0.10-1~deb12u1",
"3.0.11-1",
"3.0.11-1~deb12u1",
"3.0.11-1~deb12u2",
"3.0.12-1",
"3.0.12-2",
"3.0.13-1~deb12u1",
"3.0.13-1~deb12u2",
"3.0.14-1~deb12u1",
"3.0.14-1~deb12u2",
"3.0.15-1~deb12u1",
"3.0.16-1~deb12u1",
"3.0.17-1~deb12u1",
"3.0.17-1~deb12u2",
"3.0.17-1~deb12u3",
"3.0.18-1~deb12u1",
"3.0.18-1~deb12u2",
"3.0.19-1~deb12u1",
"3.0.19-1~deb12u2",
"3.0.20-1~deb12u1",
"3.0.20-1~deb12u2",
"3.0.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42767.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.6-1~deb13u2"
}
]
}
],
"package": {
"name": "openssl",
"purl": "pkg:deb/debian/openssl?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.5.1-1",
"3.5.1-1+deb13u1",
"3.5.2-1",
"3.5.3-1",
"3.5.4-1",
"3.5.4-1~deb13u1",
"3.5.4-1~deb13u2",
"3.5.5-1",
"3.5.5-1~deb13u1",
"3.5.5-1~deb13u2",
"3.5.6-1~deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42767.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.3-1"
}
]
}
],
"package": {
"name": "openssl",
"purl": "pkg:deb/debian/openssl?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.5.1-1",
"3.5.2-1",
"3.5.3-1",
"3.5.4-1",
"3.5.4-1~deb13u1",
"3.5.4-1~deb13u2",
"3.5.5-1",
"3.5.5-1~deb13u1",
"3.5.5-1~deb13u2",
"3.5.6-1~deb13u1",
"3.5.6-1~deb13u2",
"3.5.7-1~deb13u1",
"3.5.7-1~deb13u2",
"3.5.7-1~deb13u3",
"3.6.0-1",
"3.6.0-2",
"3.6.0~~alpha1-1",
"3.6.0~~beta1-1",
"3.6.1-1",
"3.6.1-2",
"3.6.1-3",
"3.6.2-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-42767.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56970 · Revision 1
- Added to Heist Feed
- Publisher date