CVE-2026-63076 Invalid Pointer Dereference in CMP Server via Crafted protectionAlg

Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid...

CVE-2026-63076

OpenSSL's CMP module contains a type-confusion flaw in password-based MAC (PBM) protection verification. When processing the protectionAlg parameter via X509_ALGOR_get0(), the library checks only that the value pointer is non-NULL but never validates the ASN.1 type, then casts it to ASN1_STRING a...

CVE-2026-63076

Invalid Pointer Dereference in CMP Server via Crafted protectionAlg...