CVE-2026-63074CMP Indefinite Cache Growth of ExtraCerts
Updated under an hour ago ()
Does this affect you?
It affects OpenSSL. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
- CVSS
- 5.9 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-770
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openssl
- NVD analysis
- Analyzed
- Record last updated
- Aug 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
OpenSSL OpenSSL openssl:openssl (from the name) | from 4.0.0 before 4.0.2; from 3.6.0 before 3.6.4; from 3.5.0 before 3.5.8; from 3.4.0 before 3.4.7; from 3.0.0 before 3.0.22 | CNA record |
openssl openssl openssl:openssl | from 3.0.0 before 3.0.22; from 3.4.0 before 3.4.7; from 3.5.0 before 3.5.8; from 3.6.0 before 3.6.4; from 4.0.0 before 4.0.2 | NVD |
References
- https://openssl-library.org/news/secadv/20260825.txtvendor-advisory
- https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46patch
- https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7patch
- https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54afpatch
- https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43apatch
- https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9fpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.