The Certificate Management Protocol (CMP) caches additional certificates (`extraCerts`) sent in a CMP message but fails to remove them even if the message is rejected or the certificates are invalid. In scenarios where a server frequently reuses a single `OSSL CMP CTX` object for the duration of a process, this cache can grow without limits. A remote attacker can exploit this by repeatedly sending requests containing unique additional certificates designed to be rejected, forcing the server to store them indefinitely. This leads to unbounded memory growth and may result in Out-of-Memory (OOM) conditions, causing a Denial of Service.