CVE-2026-75805

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description A CMP client that requests certificate revocation using a PKCS#10 CSR may experience a NULL pointer dereference when processing a specially crafted revocation response from a server. This occurs because the client, having sent neither an issuer name nor a serial number, lacks the necessary data to compare against the name returned by the server, leading to a crash and a Denial of Service. The issue is triggered when using the openssl cmp -cmd rr -csr <file> command or the OSSL CMP exec RR ses() function in conjunction with OSSL CMP CTX set1 p10CSR(). Exploitation requires the attacker to be a malicious or compromised CMP server, or a man-in-the-middle with access to the secret used for message protection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.