The vulnerability of the CMP module in the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the CMP module in the OpenSSL library is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the CMP module in the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the CMP module in the OpenSSL library is related to the pointer manipulation during the processing of the protectionAlg parameter. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of the CMP module in the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the CMP module in the OpenSSL library is related to deficiencies in the formatting string processing mechanism. Exploiting this vulnerability can allow a malicious actor to cause service failures...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference due to insufficient type checking in osslcmpcalcprotection in crypto/cmp/cmpprotect.c. An attacker can crash a CMP server or client by sending a crafted PBM-protected message whose protectionAlg parameter uses t...

EUVD-2026-65487

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...