CVE-2026-63073

OpenSSL CMP response validation contains a format string vulnerability (CWE-134) in ossl_cmp_msg_check_update(). When a CMP client enforces an expected sender or pins a server certificate, the peer-supplied sender distinguished name is converted via X509_NAME_oneline() and passed directly as the ...

EUVD-2026-65483

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-63073

Untrusted Sender DN Used as Format String in CMP Response Validation...