NULL Pointer Dereference Vulnerability in OpenSSL Products

CVE-2026-14457

What is CVE-2026-14457?

A NULL pointer dereference can occur in OpenSSL when only a private key is configured without an associated certificate, particularly when raw public keys (RPKs) are enabled. This situation may lead to application crashes during TLS communication if the remote peer requests raw public keys while sending the 'signature_algorithms_cert' TLS extension. Users are advised to employ best practices by configuring a corresponding certificate alongside private keys to avoid such issues. Though no data disclosure or remote code execution is possible, the risk of Denial of Service remains, requiring prompt updates to affected OpenSSL versions.

References