Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs.
Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service.
Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer dereference will happen if the examined cipher ID is unknown or unsupported.
As it is not very common to call this function in applications using the QUIC protocol and the worst outcome is Denial of Service, the issue was assessed as Low severity.
The vulnerable code was introduced in the 3.2 version with the addition of the QUIC protocol support.
The FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue, as the QUIC implementation is outside the OpenSSL FIPS module boundary.
OpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.
OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-develUpgrade opensslUpgrade openssl-libsUpgrade openssl-perl | Feb 3, 2026 | Jan 28, 2026 |
| Alpine Linux | — | Upgrade openssl | Jan 28, 2026 | Jan 27, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-perlUpgrade openssl-fips-provider-latestUpgrade openssl-libsUpgrade openssl-fips-provider-latest-debuginfoUpgrade openssl-develUpgrade openssl-snapsafe-libs-debuginfoUpgrade opensslUpgrade openssl-snapsafe-libsUpgrade openssl-debuginfoUpgrade openssl-debugsourceUpgrade openssl-libs-debuginfo | Feb 20, 2026 | Jan 27, 2026 |
| Debian | — | Upgrade openssl | Jul 23, 2026 | Jul 23, 2026 |
| Dell Idrac | — | Upgrade Dell iDRAC to the latest version | Apr 29, 2026 | Apr 28, 2026 |
| Freebsd | — | Upgrade openssl34Upgrade opensslUpgrade openssl36Upgrade openssl35Upgrade openssl33Upgrade FreeBSD | Jan 28, 2026 | Jan 27, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Mar 5, 2026 | Jan 27, 2026 |
| Oracle_linux | — | Upgrade openssl-perlUpgrade openssl-develUpgrade openssl-libsUpgrade openssl | Jan 30, 2026 | Jan 27, 2026 |
| Redhat_linux | — | Upgrade openssl-debugsourceUpgrade openssl-libs-debuginfoNo solution existsUpgrade opensslUpgrade openssl-libsUpgrade openssl-perlUpgrade openssl-debuginfoUpgrade openssl-devel | Jan 29, 2026 | Jan 27, 2026 |
| Rocky_linux | — | Upgrade openssl-libsUpgrade openssl-libs-debuginfoUpgrade openssl-develUpgrade openssl-debuginfoUpgrade openssl-debugsourceUpgrade openssl-perlUpgrade openssl | Feb 2, 2026 | Jan 30, 2026 |
| Ubuntu | — | Upgrade libssl3Upgrade opensslUpgrade libssl3t64 | Jan 28, 2026 | Jan 27, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub