CVE-2026-63074

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description The Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message but fails to remove them even if the message is rejected or the certificates are invalid. In scenarios where a server frequently reuses a single OSSL CMP CTX object for the duration of a process, this cache can grow without limits. A remote attacker can exploit this by repeatedly sending requests containing unique additional certificates designed to be rejected, forcing the server to store them indefinitely. This leads to unbounded memory growth and may result in Out-of-Memory (OOM) conditions, causing a Denial of Service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.