EUVD-2026-121711

Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMSencrypt or CMSencryptex to loop indefinitely. Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop...

CVE-2026-107496

The OpenSSL library functions CMS_encrypt() and CMS_encrypt_ex() are vulnerable to an infinite loop when processing a CMS message for an EC recipient certificate with a group order of 1 . In this scenario, random scalar generation only produces zero, causing the key generation routine to retry in...

Infinite Loop in CMS_encrypt() With an EC Group Order of 1

Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMSencrypt or CMSencryptex to loop indefinitely. Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop...