{"id":"CVE-2026-14457","title":"Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solic…","summary":"Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solic…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"openssl","product":"openssl","affected":["openssl >= 3.4.0, < 3.4.7","openssl >= 3.5.0, < 3.5.8","openssl >= 3.6.0, < 3.6.4","openssl >= 4.0.0, < 4.0.2"],"patched":["openssl 4.0.2"],"published":"2026-08-25","updated":"2026-09-11","sourceUpdated":"2026-09-11T21:14:35.873","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457","references":[{"url":"https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f","label":"openssl-security@openssl.org"},{"url":"https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b","label":"openssl-security@openssl.org"},{"url":"https://openssl-library.org/news/secadv/20260825.txt","label":"openssl-security@openssl.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-14457.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-14457"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517562"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14457"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457"},{"url":"https://access.redhat.com/errata/RHSA-2026:67154"},{"url":"https://access.redhat.com/errata/RHSA-2026:67165"},{"url":"https://access.redhat.com/errata/RHSA-2026:59641"},{"url":"https://access.redhat.com/errata/RHSA-2026:59635"},{"url":"https://access.redhat.com/errata/RHSA-2026:67956"},{"url":"https://access.redhat.com/errata/RHSA-2026:71603"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-25T14:13:25.034178Z"},"ingestedAt":"2026-09-13T19:58:38.650Z","epss":0.01021,"epssPercentile":0.61859,"slug":"CVE-2026-14457","body":"## Overview\n\nIssue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solicits raw public keys and\nalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.\n\nImpact summary: The impact is limited to a possible Denial of Service as a result of\nan application abort, no data disclosure or remote command execution are possible.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: While a passing comment in sample code in the documentation suggests\nthat key-only RPK configurations are supported, the best-practice RPK configuration\nis to always configure a corresponding certificate (possibly self-signed or\nsigned by any convenient CA).\n\nWhen the private key is configured along with a matching certificate, the\n\"signature_algorithms_cert\" extension is handled reliably even without the\nfix, and peer clients or servers that don't support raw public keys may be\nable to complete a TLS connection by pinning or verifying the corresponding\ncertificate or its public key.\n\nDeployments that prefer to configure just a private key with no certificate\nneed to upgrade to an updated release as noted below.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the SSL protocol implementation\nis outside the OpenSSL FIPS module boundary.\n\n## Affected\n\n- `openssl >= 3.4.0, < 3.4.7`\n- `openssl >= 3.5.0, < 3.5.8`\n- `openssl >= 3.6.0, < 3.6.4`\n- `openssl >= 4.0.0, < 4.0.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openssl 4.0.2`\n\n## Vendor advisories\n\n- **RHSA-2026:67154** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67154)\n- **RHSA-2026:67165** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67165)\n- **RHSA-2026:59641** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59641)\n- **RHSA-2026:59635** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59635)\n- **Red Hat VEX** · Low · affected: Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat JBoss Core Services, Red Hat JBoss Web Server 6, Red Hat JBoss Web Server 7, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat JBoss Core Services, Red Hat JBoss Web Server 6, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-14457.json)\n- **RHSA-2026:67956** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67956)\n- **RHSA-2026:71603** · Red Hat · fixed in: Red Hat Update Infrastructure 5 · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71603)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}