CVE-2026-63074
Received Received - Intake

Memory Leak in OpenSSL CMP Server via Unbounded Certificate Caching

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: OpenSSL Software Foundation

Description
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-63074
EUVD
EUVD-2026-65484

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl to 2026-63074 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the OpenSSL Certificate Management Protocol (CMP) caching extra certificates sent in messages without removing them. If a server reuses a single context frequently, the cache of extra certificates can grow indefinitely, potentially causing memory exhaustion if a malicious client sends repeated requests with unique certificates.

Detection Guidance

This vulnerability involves unbounded memory growth in OpenSSL's CMP server due to improper handling of extra certificates in rejected messages. Detection requires monitoring for excessive memory usage in OpenSSL CMP server processes and checking for repeated rejected CMP messages with large extra certificate lists. No specific commands are provided in the context, but monitoring tools like top, htop, or ps for memory usage and network traffic analysis tools for CMP protocol messages may help identify anomalous behavior.

Impact Analysis

If you operate a CMP server that reuses a single context for its lifetime, an attacker could exploit this flaw to cause unbounded memory growth. This may lead to out-of-memory conditions, degrading server performance or causing crashes.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions through unbounded memory growth due to certificate cache flooding. It does not directly affect data confidentiality or integrity but may lead to service unavailability, which could indirectly impact compliance with standards requiring availability (e.g., HIPAA for healthcare systems). GDPR compliance is not directly affected unless service disruption leads to data processing delays.

Mitigation Strategies

Update OpenSSL to a patched version where the CMP extraCerts caching issue is resolved. Avoid reusing OSSL_CMP_CTX objects for long periods in CMP servers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63074. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart