CVE-2026-63076

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description An issue exists in the Certificate Management Protocol (CMP) password-based MAC protection verification. The library uses the X509 ALGOR get0() function to read the protectionAlg algorithm parameter, which returns a parameter type and a value pointer. The system casts this value to an ASN1 STRING and treats it as a PBMParameter after verifying only that the pointer is not NULL, failing to consult the actual parameter type. A remote, unauthenticated attacker can send a crafted message containing a parameter of a different type, leading to an invalid pointer dereference. This can result in a Denial of Service (DoS) by crashing applications acting as CMP servers that accept PBM-protected messages, or CMP clients interacting with a malicious or intercepted server. This occurs within the OSSL CMP SRV process request() function on the server side and during response validation on the client side. This issue requires the CMP feature to be explicitly enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.