NULL pointer dereference in OpenSSL
CVE-2026-42764
Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.008 · change: -0.004
Affected products
- OpenSSL — versions 4.0.0, 3.6.0, 3.5.0
Weakness classification (CWE)
References
- github.com/openssl/security/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729
- github.com/openssl/security/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677
- github.com/openssl/security/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91
- openssl-library.org/news/secadv/20260609.txt (vendor-advisory, Vendor Advisory)
- github.com/openssl/openssl/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729 (Patch, patch)
- github.com/openssl/openssl/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677 (Patch, patch)
- github.com/openssl/openssl/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91 (Patch, patch)
Frequently asked questions
- What is CVE-2026-42764?
- CVE-2026-42764 is a high-severity vulnerability in OpenSSL, classified under NULL Pointer Dereference. CVSS score: 7.5/10. Published 2026-06-09.
- How severe is CVE-2026-42764?
- High severity. CVSS v3 base score is 7.5 out of 10.