From d3a901e8d9f021f3e67d6cfbc12e768129862726 Mon Sep 17 00:00:00 2001
From: Daniel Kubec <kubec@openssl.org>
Date: Tue, 17 Mar 2026 11:11:22 +0100
Subject: [PATCH] Fix NULL Dereference When Delta CRL Lacks CRL Number
 Extension
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes CVE-2026-28388

Co-authored-by: Igor Morgenstern <igor.morgenstern@aisle.com>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Apr  6 19:27:16 2026
(cherry picked from commit d6ad8595e86dc96ca8771f0a1714b31794befa75)
---
 crypto/x509/x509_vfy.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 01ce14982d6e0..d55141e014d84 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -1308,6 +1308,8 @@ static int check_delta_base(X509_CRL *delta, X509_CRL *base)
     if (ASN1_INTEGER_cmp(delta->base_crl_number, base->crl_number) > 0)
         return 0;
     /* Delta CRL number must exceed full CRL number */
+    if (delta->crl_number == NULL)
+        return 0;
     return ASN1_INTEGER_cmp(delta->crl_number, base->crl_number) > 0;
 }
 
