Unbounded Memory Growth in OpenSSL CMP due to Improper Certificate Handling

CVE-2026-63074

What is CVE-2026-63074?

The OpenSSL Certificate Management Protocol (CMP) improperly caches additional certificates in a server context, leading to potential Denial of Service. If a malicious client continuously sends requests with unique extra certificates, the server could experience unbounded memory growth. This unregulated caching can cause the server to become unresponsive, especially if the context (OSSL_CMP_CTX) is reused over time. The vulnerability poses a severe risk to servers that manage CMP requests without addressing this caching issue, as untrusted certificates persist indefinitely after rejected messages.

References