CVE-2021-3449
NULL pointer deref in signature_algorithms processing
Description
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
Official description from the CVE record, published by openssl. Copyright © 1999-2026 The MITRE Corporation. See /security/cve/legal for the CVE license. View the record on cve.org
Key data
EPSS
- Score
- 0.63542 (63.5% probability)
- Percentile
- 99.2%
- Scores of
- Nov 10, 2026
- Model
- v2026.06.15
CISA assessment as of Oct 8, 2026
- Automatable
- yes
- Technical impact
- partial
Affected products
OpenSSL
- affected: Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)
References
- openssl.org/news/secadv/20210325.txt
- git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb…
- 20210325 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2021 (tools.cisco.com)vendor-advisory
- DSA-4875 (debian.org)vendor-advisory
- [oss-security] 20210327 OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing (openwall.com)mailing-list
- [oss-security] 20210327 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing (openwall.com)mailing-list
- [oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing (openwall.com)mailing-list
- [oss-security] 20210328 Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in signature_algorithms processing (openwall.com)mailing-list
- GLSA-202103-03 (security.gentoo.org)vendor-advisory
- FEDORA-2021-cbf14ab8f9 (lists.fedoraproject.org)vendor-advisory
- oracle.com/security-alerts/cpuApr2021.html
- tenable.com/security/tns-2021-10
- tenable.com/security/tns-2021-09
- security.netapp.com/advisory/ntap-20210513-0002
- security.netapp.com/advisory/ntap-20210326-0006
- security.freebsd.org/advisories/FreeBSD-SA-21:07.openssl.asc
- tenable.com/security/tns-2021-06
- tenable.com/security/tns-2021-05
- kc.mcafee.com/corporate/index?page=content&id=SB10356
- oracle.com//security-alerts/cpujul2021.html
- cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf
- kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA448…
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013
- [debian-lts-announce] 20210831 [SECURITY] [DLA 2751-1] postgresql-9.6 security update (lists.debian.org)mailing-list
- oracle.com/security-alerts/cpuoct2021.html
- oracle.com/security-alerts/cpuapr2022.html
- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- oracle.com/security-alerts/cpujul2022.html
- security.netapp.com/advisory/ntap-20240621-0006
Timeline
- ID reserved
- Record published
- Record last updated
Look up another CVE
About CubePath
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 19:50 UTC. Sources and licenses