Skip to content
Fencer Vulns
medium 6.2

CVE-2026-42771 json

Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

published 2026-06-09 5 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-35488

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits
0
none known

Summary

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen.

Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service.

An internal helper function called from X509_VERIFY_PARAM_[set|add]_email() used a wrong length when validating the local part of an email address. This could cause the 64 octet limit on the local part of an email address to be not enforced, or cause an out of bound read and potentially a crash.

The bug is reachable via S-MIME validation with a crafted From: address supplied in an email message that can potentially cause a crash.

No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Patch / fix

  • OpenSSL OpenSSL 4.0.1
  • bootupd hummingbird 1 0.3.2-1.hum1
  • rust-bootupd hummingbird 1 0.3.2-1.hum1
  • ruby3.4 hummingbird 1 3.4.10-31.7.hum1
  • ruby3.4-libs hummingbird 1 3.4.10-31.7.hum1
  • ruby3.4-bundled-gems hummingbird 1 3.4.10-31.7.hum1
  • ruby3.4-default-gems hummingbird 1 3.4.10-31.7.hum1
  • ruby4.0 hummingbird 1 4.0.6-37.3.hum1
  • ruby4.0-libs hummingbird 1 4.0.6-37.3.hum1

red hat advisories RHSA-2026:67551RHSA-2026:62790RHSA-2026:62563RHSA-2026:62562RHSA-2026:55543RHSA-2026:42825

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42771 updated cvss 6.5

openssl: Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

  • Red Hat Enterprise Linux 6 openssl, openssl-perl Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF Red Hat Enterprise Linux 8 edk2, shim, openssl, shim-x64, edk2-ovmf, shim-aa64, +9 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 9 edk2, shim, shim-x64, edk2-ovmf, shim-aa64, edk2-tools, +4 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 10 edk2, shim, openssl, shim-unsigned-x64, shim-unsigned-aarch64 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images bootupd 0.3.2-1.hum1, chunkah 0.6.0-3.hum1, openssl 3.5.8-0.1.hum1, openssl3 3.5.8-0.1.hum1, ruby4.0 4.0.6-37.3.hum1, ruby3.3 3.3.10-23.6.hum1, +20 more
    fixed: vendor fix RHSA-2026:67551
  • Red Hat Enterprise Linux 9 openssl, openssl-libs, openssl-perl Red Hat Hardened Images rust, unbound, netavark, openshell, rust-podman-sequoia, rubygem3.3-rbs 3.4.0-23.6.hum1, +50 more Red Hat JBoss Core Services jbcs-httpd24-openssl, jbcs-httpd24-openssl-libs, jbcs-httpd24-openssl-perl, jbcs-openssl-win6-x86_64.zip 3.5.5-SP4 Red Hat JBoss Web Server 6 jws-optional-native-components-win6-x86_64.zip 6.2.4.ER1 Red Hat JBoss Web Server 7 jws-optional-native-components-win6-x86_64.zip 6.2.4.ER1
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • OpenSSL OpenSSL

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.