CVE-2026-63074

/// Technical description

Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches

additional certificates (extraCerts) sent in a CMP message, but never expunges

them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX

frequently, this cache of extraCerts may grow unboundedly, and a malicious

client may flood a CMP server with requests driving this growth.

Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX

for the lifetime of a server process may observe unbounded memory growth in the

event a malicious client repeatedly sends requests containing unique extra

certificates, which may lead to OOM conditions.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: If a remote user sends CMP messages to a server with a list of

extraCerts and the message is rejected, the extraCerts from the message remains

in the server contexts untrusted certificate stack. This exposes servers with

long lived ctx objects to Denial of Service a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References