CVE-2026-107496

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 4.0 OpenSSL versions 4.0 and later (only when configured with the enable-ec explicit curves option)

Description Encrypting a CMS message to an EC certificate with a group order of 1 can cause the CMS encrypt() or CMS encrypt ex() functions to loop indefinitely. This occurs because the key generation routine retries without limit while waiting for a nonzero private scalar, which cannot be produced if the group order is 1. An attacker who can provide a recipient certificate with controlled EC parameters to an application performing CMS encryption can trigger this behavior, leading to a Denial of Service by consuming a CPU core until the process is interrupted. The OpenSSL TLS and QUIC implementations are not affected, and FIPS modules in versions 3.0, 3.5, 4.0, and 4.1 are not impacted as they reject arbitrary explicit EC domain parameters.

Recommendations Update OpenSSL to a version where EC key generation fails when the group has no valid nonzero private scalar. For versions 4.0 and later, avoid configuring the software with the enable-ec explicit curves option. As a temporary mitigation, restrict the use of the CMS encrypt() and CMS encrypt ex() functions when processing recipient certificates from untrusted sources.