CLSA-2026-1789738618 openssl: Fix of 4 CVEs

CVE-2026-63074: roll cached CMP extraCerts back off ctx-untrusted on both message-rejection paths, so a client that repeatedly sends rejected messages can no longer grow a long-lived OSSLCMPCTX without bound - CVE-2026-63076: require the CMP protectionAlg parameter to be a VASN1SEQUENCE before it...

openssl: RPK server signature algorithm selection can dereference a missing certificate

A flaw was found in OpenSSL. In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, where only the private key with no certificate is configured, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

CVE-2026-55960: Improper Certificate Validation

Un-negotiated Raw Public Key RFC 7250 accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually negotiated for that peer...

CVE-2024-12797 RFC7250 handshakes with unauthenticated servers don't abort as expected

Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...