The vulnerability arises when an OpenSSL‑enabled application verifies a partial certificate chain while enabling OCSP response checking for the entire chain. Under these conditions, the library attempts to traverse the chain to locate the issuer of each certificate; if the chain lacks a self‑signed trusted anchor, the issuer pointer for the last certificate becomes null. Later code incorrectly dereferences this null pointer, causing a crash. The crash results in a denial of service against the affected application, compromising availability. The weakness maps to CWE‑476, a null pointer dereference.

The flaw exists in the OpenSSL cryptographic library, specifically when both X509_V_FLAG_OCSP_RESP_CHECK_ALL and X509_V_FLAG_PARTIAL_CHAIN are set during verification. No specific software versions are listed, so all OpenSSL deployments that enable both flags are affected. Applications that rely on default settings—where neither flag is enabled—are not impacted.

The vulnerability has been assigned low severity because the two flags that trigger the issue are disabled by default. Exploitation requires an attacker to control the verification flags or provide a specially crafted certificate chain to the application. Since EPSS is unavailable and the flaw is not in CISA’s KEV catalog, the probability of widespread exploitation is expected to remain low. Nonetheless, the crash can be leveraged to render a service unavailable if the affected application is exposed to untrusted data. The CVSS score is 7.5.