CVE-2026-42771

Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

6.2 Medium

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen.

Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service.

An internal helper function called from X509_VERIFY_PARAM_[set|add]_email() used a wrong length when validating the local part of an email address. This could cause the 64 octet limit on the local part of an email address to be not enforced, or cause an out of bound read and potentially a crash.

The bug is reachable via S-MIME validation with a crafted From: address supplied in an email message that can potentially cause a crash.

No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.22%Up 0.2 points since Jun 10, 2026

What each source reports

CVE List Score used 6.2

Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen.

Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service.

The bug is reachable via S-MIME validation with a crafted From: address supplied in an email message that can potentially cause a crash.

No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Record: CVE-2026-42771
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

EUVDEUVD-2026-35488 6.2

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen.

Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service.

The bug is reachable via S-MIME validation with a crafted From: address supplied in an email message that can potentially cause a crash.

No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Record: EUVD-2026-35488
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6fmj-jmjq-qcmg 6.2

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a...

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen.

Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service.

The bug is reachable via S-MIME validation with a crafted From: address supplied in an email message that can potentially cause a crash.

No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Record: GHSA-6fmj-jmjq-qcmg
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 6.2

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen.

Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service.

The bug is reachable via S-MIME validation with a crafted From: address supplied in an email message that can potentially cause a crash.

No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Record: CVE-2026-42771
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVBELL-CVE-2026-42771 6.2

CVE-2026-42771 does not affect BellSoft software

Record: BELL-CVE-2026-42771
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 6.2

Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen.

Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service.

The bug is reachable via S-MIME validation with a crafted From: address supplied in an email message that can potentially cause a crash.

No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Record: CVE-2026-42771
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

Show 9 moreShow less

OSVRHSA-2026:42825 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:42825
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:55543 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:55543
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:59635 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:59635
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:59641 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:59641
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:62562 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:62562
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:62563 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:62563
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:62790 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:62790
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:67551 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:67551
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-42771 6.2

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service. An internal helper function called from X509_VERIFY_PARAM_[set|add]_email() used a wrong length when validating the local part of an email address. This could cause the 64 octet limit on the local part of an email address to be not enforced, or cause an out of bound read and potentially a crash. The bug is reachable via S-MIME validation with a crafted From: address supplied in an email message that can potentially cause a crash. No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Record: UBUNTU-CVE-2026-42771
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

openssl

Affected packages

Affected packages
Package	Affected	Fixed
`chunkah` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:0.6.0-3.hum1	0:0.6.0-3.hum1
`python-cryptography` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:50.0.0-1.hum1	0:50.0.0-1.hum1
`python3-cryptography` Red Hat:hummingbird:1 From an advisory covering 24 CVEs	before 0:50.0.0-1.hum1	0:50.0.0-1.hum1
`openssl3` Red Hat:hummingbird:1 From an advisory covering 27 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`openssl3-devel` Red Hat:hummingbird:1 From an advisory covering 27 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`openssl3-devel-engine` Red Hat:hummingbird:1 From an advisory covering 27 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`openssl3-libs` Red Hat:hummingbird:1 From an advisory covering 27 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`openssl` Red Hat:hummingbird:1 From an advisory covering 28 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`openssl-config-fips` Red Hat:hummingbird:1 From an advisory covering 28 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`openssl-devel` Red Hat:hummingbird:1 From an advisory covering 28 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1

Show 61 moreShow less

Affected packages
Package	Affected	Fixed
`openssl-devel-engine` Red Hat:hummingbird:1 From an advisory covering 28 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`openssl-fips-provider-upstream` Red Hat:hummingbird:1 From an advisory covering 28 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`openssl-libs` Red Hat:hummingbird:1 From an advisory covering 28 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`openssl-perl` Red Hat:hummingbird:1 From an advisory covering 28 CVEs	before 0:3.5.8-0.1.hum1	0:3.5.8-0.1.hum1
`ruby3.3` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.3.10-23.6.hum1	0:3.3.10-23.6.hum1
`ruby3.3-bundled-gems` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.3.10-23.6.hum1	0:3.3.10-23.6.hum1
`ruby3.3-default-gems` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.3.10-23.6.hum1	0:3.3.10-23.6.hum1
`ruby3.3-devel` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.3.10-23.6.hum1	0:3.3.10-23.6.hum1
`ruby3.3-doc` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.3.10-23.6.hum1	0:3.3.10-23.6.hum1
`ruby3.3-libs` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.3.10-23.6.hum1	0:3.3.10-23.6.hum1
`rubygem3.3-bigdecimal` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.1.5-23.6.hum1	0:3.1.5-23.6.hum1
`rubygem3.3-bundler` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:2.5.22-23.6.hum1	0:2.5.22-23.6.hum1
`rubygem3.3-devel` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.5.22-23.6.hum1	0:3.5.22-23.6.hum1
`rubygem3.3-io-console` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:0.7.1-23.6.hum1	0:0.7.1-23.6.hum1
`rubygem3.3-irb` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:1.13.1-23.6.hum1	0:1.13.1-23.6.hum1
`rubygem3.3-json` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:2.7.2-23.6.hum1	0:2.7.2-23.6.hum1
`rubygem3.3-minitest` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:5.20.0-23.6.hum1	0:5.20.0-23.6.hum1
`rubygem3.3-power_assert` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:2.0.3-23.6.hum1	0:2.0.3-23.6.hum1
`rubygem3.3-psych` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:5.1.2-23.6.hum1	0:5.1.2-23.6.hum1
`rubygem3.3-racc` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:1.7.3-23.6.hum1	0:1.7.3-23.6.hum1
`rubygem3.3-rake` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:13.1.0-23.6.hum1	0:13.1.0-23.6.hum1
`rubygem3.3-rbs` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.4.0-23.6.hum1	0:3.4.0-23.6.hum1
`rubygem3.3-rdoc` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:6.6.3.1-23.6.hum1	0:6.6.3.1-23.6.hum1
`rubygem3.3-rexml` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.4.4-23.6.hum1	0:3.4.4-23.6.hum1
`rubygem3.3-rss` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:0.3.1-23.6.hum1	0:0.3.1-23.6.hum1
`rubygem3.3-rubygems` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.5.22-23.6.hum1	0:3.5.22-23.6.hum1
`rubygem3.3-test-unit` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:3.6.1-23.6.hum1	0:3.6.1-23.6.hum1
`rubygem3.3-typeprof` Red Hat:hummingbird:1 From an advisory covering 22 CVEs	before 0:0.21.9-23.6.hum1	0:0.21.9-23.6.hum1
`ruby4.0` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.6-37.3.hum1	0:4.0.6-37.3.hum1
`ruby4.0-bundled-gems` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.6-37.3.hum1	0:4.0.6-37.3.hum1
`ruby4.0-default-gems` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.6-37.3.hum1	0:4.0.6-37.3.hum1
`ruby4.0-devel` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.6-37.3.hum1	0:4.0.6-37.3.hum1
`ruby4.0-doc` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.6-37.3.hum1	0:4.0.6-37.3.hum1
`ruby4.0-libs` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.6-37.3.hum1	0:4.0.6-37.3.hum1
`rubygem4.0-bigdecimal` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.1-37.3.hum1	0:4.0.1-37.3.hum1
`rubygem4.0-bundler` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.16-37.3.hum1	0:4.0.16-37.3.hum1
`rubygem4.0-devel` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.16-37.3.hum1	0:4.0.16-37.3.hum1
`rubygem4.0-io-console` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:0.8.2-37.3.hum1	0:0.8.2-37.3.hum1
`rubygem4.0-irb` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:1.16.0-37.3.hum1	0:1.16.0-37.3.hum1
`rubygem4.0-json` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:2.18.0-37.3.hum1	0:2.18.0-37.3.hum1
`rubygem4.0-minitest` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:6.0.0-37.3.hum1	0:6.0.0-37.3.hum1
`rubygem4.0-power_assert` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:3.0.1-37.3.hum1	0:3.0.1-37.3.hum1
`rubygem4.0-psych` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:5.3.1-37.3.hum1	0:5.3.1-37.3.hum1
`rubygem4.0-racc` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:1.8.1-37.3.hum1	0:1.8.1-37.3.hum1
`rubygem4.0-rake` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:13.3.1-37.3.hum1	0:13.3.1-37.3.hum1
`rubygem4.0-rbs` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:3.10.0-37.3.hum1	0:3.10.0-37.3.hum1
`rubygem4.0-rdoc` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:7.0.4-37.3.hum1	0:7.0.4-37.3.hum1
`rubygem4.0-rexml` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:3.4.4-37.3.hum1	0:3.4.4-37.3.hum1
`rubygem4.0-rss` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:0.3.2-37.3.hum1	0:0.3.2-37.3.hum1
`rubygem4.0-rubygems` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:4.0.16-37.3.hum1	0:4.0.16-37.3.hum1
`rubygem4.0-test-unit` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:3.7.5-37.3.hum1	0:3.7.5-37.3.hum1
`rubygem4.0-typeprof` Red Hat:hummingbird:1 From an advisory covering 21 CVEs	before 0:0.31.1-37.3.hum1	0:0.31.1-37.3.hum1
`ruby3.4` Red Hat:hummingbird:1 From an advisory covering 19 CVEs	before 0:3.4.10-31.7.hum1	0:3.4.10-31.7.hum1
`ruby3.4-bundled-gems` Red Hat:hummingbird:1 From an advisory covering 19 CVEs	before 0:3.4.10-31.7.hum1	0:3.4.10-31.7.hum1
`ruby3.4-default-gems` Red Hat:hummingbird:1 From an advisory covering 19 CVEs	before 0:3.4.10-31.7.hum1	0:3.4.10-31.7.hum1
`ruby3.4-devel` Red Hat:hummingbird:1 From an advisory covering 19 CVEs	before 0:3.4.10-31.7.hum1	0:3.4.10-31.7.hum1
`ruby3.4-doc` Red Hat:hummingbird:1 From an advisory covering 19 CVEs	before 0:3.4.10-31.7.hum1	0:3.4.10-31.7.hum1
`ruby3.4-libs` Red Hat:hummingbird:1 From an advisory covering 19 CVEs	before 0:3.4.10-31.7.hum1	0:3.4.10-31.7.hum1
`bootupd` Red Hat:hummingbird:1 From an advisory covering 19 CVEs	before 0:0.3.2-1.hum1	0:0.3.2-1.hum1
`rust-bootupd` Red Hat:hummingbird:1 From an advisory covering 19 CVEs	before 0:0.3.2-1.hum1	0:0.3.2-1.hum1
`nodejs` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3 Show 7 moreShow less 12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42771 is a medium vulnerability (CVSS 6.2) in Openssl, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.

References

Show 189 moreShow less