AIKIDO-2026-983127
openssl is vulnerable to NULL Pointer Dereference
37
Low Risk
This Affects:
opensslTL;DR
OpenSSL selects a signature algorithm for a raw public key configuration from the peer signature_algorithms_cert extension. When only a private key is configured and no certificate is attached, that selection reads a missing certificate pointer and aborts the process. The fix requires a certificate before it reads that pointer.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable raw public keys with a private key and no certificate.
Background info
openssl is vulnerable to NULL Pointer Dereference in versions 3.4.0 - 3.4.6, 3.5.0 - 3.5.7, 3.6.0 - 3.6.3 and 4.0.0 - 4.0.1.
How to fix this
Upgrade the openssl library to the patch version.
Links
GitHub Release
Fix Commits
github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7fgithub.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.