CVE-2026-42769

OpenSSL is vulnerable to trust-anchor substitution due to a typo in the certificate chain building code when processing Certificate Management Protocol (CMP) messages. Specifically, in the id-it-rootCaKeyUpdate message (RFC 9810), the code incorrectly adds the newWithOld certificate instead of th...