CVE-2026-28388
NULL Pointer Dereference in OpenSSL Delta CRL Processing Causes DoS
Publication date: 2026-04-07
Last updated on: 2026-04-23
Assigner: OpenSSL Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openssl | openssl | From 3.0.0 (inc) to 3.0.20 (exc) |
| openssl | openssl | From 3.3.0 (inc) to 3.3.7 (exc) |
| openssl | openssl | From 3.4.0 (inc) to 3.4.5 (exc) |
| openssl | openssl | From 3.5.0 (inc) to 3.5.6 (exc) |
| openssl | openssl | From 3.6.0 (inc) to 3.6.2 (exc) |
| openssl | openssl | From 1.0.2 (inc) to 1.0.2zp (exc) |
| openssl | openssl | From 1.1.1 (inc) to 1.1.1zg (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when processing a delta Certificate Revocation List (CRL) that contains a Delta CRL Indicator extension but is missing the required CRL Number extension. In this case, the software attempts to access a NULL pointer because it does not check if the CRL Number extension is present before using it.
This NULL pointer dereference can cause the application to crash during X.509 certificate verification if delta CRL processing is enabled.
Exploitation requires specific conditions: the verification context must have the X509_V_FLAG_USE_DELTAS flag enabled, the certificate must contain a freshestCRL extension or the base CRL must have the EXFLAG_FRESHEST flag set, and an attacker must provide a malformed CRL.
The vulnerability leads to a Denial of Service (DoS) but cannot be used to execute code or disclose memory.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a Denial of Service (DoS) condition. An attacker can cause an application that processes X.509 certificates with delta CRL checking enabled to crash by supplying a malformed delta CRL.
This crash disrupts the normal operation of the application, potentially causing service interruptions or downtime.
However, this vulnerability does not allow for code execution or memory disclosure, limiting its severity to a low level.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability described causes a denial of service through a NULL pointer dereference when processing malformed delta CRLs during X.509 certificate verification. It does not lead to code execution or data disclosure.
There is no information provided about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.