CVE-2021-23841

CVE-2021-23841 is a medium-severity denial-of-service vulnerability in OpenSSL versions 1.1.1i and below, as well as 1.0.2x and below. It arises from improper error handling in the X509_issuer_and_serial_hash() function when processing maliciously constructed X.509 certificate issuer fields, leading to a NULL pointer dereference and application crash. This vulnerability primarily impacts applications that directly use this specific OpenSSL function on untrusted certificates. The vulnerability has a CVSS score of 5.9, indicating a medium severity. An unauthenticated attacker can trigger this vulnerability over the network with high attack complexity, resulting in a denial-of-service impact. There is no impact on confidentiality or integrity. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low current attention.