CVE-2026-42765

Issue summary: When a partial-chain certificate verification is enabled

together with OCSP response checking for the whole chain, a NULL dereference

will happen if the verified chain does not have a self-signed trusted anchor,

crashing the process.

Impact summary: A NULL pointer dereference can trigger a crash which leads to a

Denial of Service for an application.

When performing OCSP response checking for certificates in the verification

chain, the code always tries to access the next certificate as the issuer.

There is a check for a self-signed certificate. However with the partial

chain verification enabled when the chain does not have a self-signed trusted

anchor, the issuer will be NULL for the last certificate in the chain. A NULL

pointer dereference then happens.

This issue affects only applications which enable both OCSP verification

of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial

chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate

verification. Both flags are disabled by default. For that reason, we have

assigned Low severity to the issue.

No FIPS modules are affected by this issue as the affected code is outside

the OpenSSL FIPS module boundary.