CVE-2026-42767

CVE-2026-42767 affects OpenSSL CMP client handling of CRMF CertRepMessage EncryptedValue: if symmAlg OID is present but parameters are missing in a CMP response crafted by a malicious CMP server/ MITM, it triggers a NULL pointer dereference, causing a crash and DoS. Affected: CMP clients processi...

CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption

Issue summary: An attacker-controlled CMP Certificate Management Protocol server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server or acti...

PT-2026-47837

Issue summary: An attacker-controlled CMP Certificate Management Protocol server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server or acti...