CVE-2026-14457 is a NULL pointer dereference vulnerability (CWE-476) in OpenSSL affecting server and client configurations using RFC7250 Raw Public Keys (RPKs) with only a private key configured and no associated certificate. The flaw is triggered when a remote peer solicits raw public keys and sends the typically omitted 'signature_algorithms_cert' TLS extension, causing an application abort. The impact is limited to a Denial of Service; no data disclosure or remote code execution is possible. Configurations that include both a private key and a matching certificate are not affected. FIPS modules are unaffected as the SSL implementation is outside the OpenSSL FIPS module boundary. The recommended mitigation is to always configure a corresponding certificate alongside the private key, or to upgrade to a patched release. Multiple commits have been issued across OpenSSL branches to address the issue.