CVE-2026-14457

A flaw was found in OpenSSL. In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, where only the private key (with no certificate) is configured, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. This issue results in a denial of service.

Server or client configurations with RPKs (RFC7250 Raw Public Keys) enabled, where only the private key (with no associated certificate) is configured, are vulnerable to this issue. However, key-only RPK configurations are not considered a best practice, limiting the exposure of this flaw. This issue can cause a NULL pointer dereference, resulting in a denial of service due to an application abort. There is no data disclosure or command execution. For these reasons, this vulnerability has been rated with a low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.