CVE-2026-63074

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

CVE-2026-63074

CVE-2026-63074 affects OpenSSL's CMP (Certificate Management Protocol) module. When a CMP message is rejected, its extraCerts remain in the server's OSSL_CMP_CTX untrusted certificate stack indefinitely. An attacker can exploit this by repeatedly sending rejected messages containing unique extra ...

EUVD-2026-65484

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

CVE-2026-63074 CMP Indefinite Cache Growth of ExtraCerts

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

CVE-2026-63074

CMP Indefinite Cache Growth of ExtraCerts...