CVE-2026-63073

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description An issue exists in the CMP response validation where the ossl cmp msg check update() function converts a peer-supplied sender distinguished name using X509 NAME oneline() and passes it directly as the format argument to ERR raise data(). Because percent characters are preserved during conversion, a malicious or intercepted CMP endpoint can provide a sender DN containing format specifiers like %s or %n. These specifiers reach BIO vsnprintf() without matching variadic arguments, causing the client to dereference or write through unrelated stack contents. This leads to a denial of service by crashing the CMP client, specifically when the client enforces an expected sender or uses a pinned server certificate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.