CVE-2026-42764 NULL Pointer Dereference in QUIC Server Initial Packet Handling

What is CVE-2026-42764?

CVE-2026-42764 is a high-severity vulnerability in Openssl Openssl, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled.

Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service.

If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token.

By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Weakness: CWE-476

Which versions are affected by CVE-2026-42764?

It affects 1 product.

Products include Openssl Openssl.

How do I fix CVE-2026-42764?

Apply the vendor's patch.

Is CVE-2026-42764 being exploited?

There is no known exploitation of CVE-2026-42764 in the wild and no public exploit code.

Other vulnerabilities in Openssl Openssl

• CVE-2009-3245 Null dereference in n/a Critical 10.0
• CVE-2006-3738 Memory corruption in n/a Critical 10.0
• CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation Critical 9.8
• CVE-2016-6309 Use after free in n/a Critical 9.8
• CVE-2016-0799 Integer overflow in n/a Critical 9.8

All Openssl Openssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-42764, BELL-CVE-2026-42764, DEBIAN-CVE-2026-42764, GHSA-5pg7-f6xv-j6m4, JLSEC-2026-1137, MINI-pp4h-f74w-w939 and 1 more.