Analysis of CVE-2026-42769 for EOL versions

[filiagees]

I have a question that arose during my analysis of CVE-2026-42769.

The announcement at https://openssl-library.org/news/secadv/20260609.txt states:

OpenSSL 4.0, 3.6, 3.5, and 3.4 are vulnerable to this issue.

OpenSSL 4.0 users should upgrade to OpenSSL 4.0.1.
OpenSSL 3.6 users should upgrade to OpenSSL 3.6.3.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.7.
OpenSSL 3.4 users should upgrade to OpenSSL 3.4.6.

However, versions 3.2 and 3.3 are not explicitly mentioned; neither as vulnerable nor as unaffected.

I am aware that OpenSSL 3.2 reached End of Life on 2025-11-25, https://openssl-library.org/post/2025-11-25-eol-32/
(which likely explains why no patch was issued for it).

That said, I'd still like to understand whether it is considered vulnerable.

Looking at the patches, the fix modifies cmp_genm.c in three ways (1)
And, the same unpatched code patterns appear to still be present in OpenSSL 3.3, example:

1. static int selfsigned_verify_cb
2. static int verify_ss_cert
3. verify_ss_cert_trans()

My questions are:

• Is OpenSSL 3.2/3.3 affected by the same vulnerability?
  • I assume it is (but I'm not a C developer, so please correct me if my assumptions are wrong).
• If so, was the decision not to patch it solely due to EOL status; correct?

I am trying to better understand the CVE patching process and its scope.
No criticism of anyone's work is intended :)

Thanks!

---

(1)

1. Inside static int selfsigned_verify_cb:

   • From: if (X509_add_cert(chain, cert, X509_ADD_FLAG_UP_REF))
   • To: if (X509_add_cert(chain, issuer, X509_ADD_FLAG_UP_REF))

2. Inside static int verify_ss_cert():

   • Adds a call to X509_STORE_CTX_set_flags()

3. Inside verify_ss_cert_trans():

   • From: X509_VERIFY_PARAM *vpm = X509_STORE_get0_param(ts);
   • To: X509_VERIFY_PARAM *vpm = (ts == NULL) ? NULL : X509_STORE_get0_param(ts);

[idrassi]

OpenSSL 3.2 and 3.3 are affected by CVE-2026-42769 and the only possible reason they weren't patched is that both branches had already reached end-of-life before the advisory was published.

The affected API was added in commit 01b0485 ("CMP: add support for genm with rootCaCert and genp with rootCaKeyUpdate", July 2023). That commit first shipped in OpenSSL 3.2.0, so every 3.2.x and 3.3.x release contains the vulnerable code.

[filiagees]

yeah, it does make sense. Thanks @idrassi