MNBSD-2026-31: NULL pointer dereference when processing a delta CRL

Description

When a delta CRL containing a Delta CRL Indicator extension is processed, a NULL pointer dereference can occur if the required CRL Number extension is missing, triggering a crash (Denial of Service). Severity: Low (OpenSSL).

Affected Versions

openssl

Recommendations

No specific recommendations provided.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-28388
• https://openssl-library.org/news/vulnerabilities/#CVE-2026-28388

Additional Information

Aliases: CVE-2026-28388

Published: June 11, 2026
Last Modified: June 11, 2026