CVE-2026-63074 OpenSSL CVE debrief

Who should care

Defenders responsible for OpenSSL CMP servers, security teams managing OpenSSL deployments, and administrators of systems using affected OpenSSL versions should assess exposure and prioritize patching.

Why it matters

The OpenSSL CMP cache unbounded growth vulnerability allows for potential DoS attacks and OOM conditions, requiring defenders to assess exposure, prioritize patching, and monitor for unusual activity.

• Potential for OOM conditions due to unbounded cache growth
• Denial of Service (DoS) attacks through repeated sending of rejected CMP messages with large lists of additional certificates
• Need for verification of OpenSSL version and exposure in environments
• Priority for patching and updating affected OpenSSL versions

Technical summary

The OpenSSL Certificate Management Protocol (CMP) caches additional certificates sent in a CMP message but never expunges them if they are invalid. A malicious client may flood a CMP server with requests driving unbounded growth of the cache of extraCerts, potentially leading to OOM conditions. This issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. The vulnerability affects OpenSSL versions 3.0.0 to 3.0.22, 3.4.0 to 3.4.7, 3.5.0 to 3.5.8, 3.6.0 to 3.6.4, and 4.0.0 to 4.0.2.

Defensive priority

Defenders should prioritize verifying and applying patches for OpenSSL versions 3.0.0 to 3.0.22, 3.4.0 to 3.4.7, 3.5.0 to 3.5.8, 3.6.0 to 3.6.4, and 4.0.0 to 4.0.2, and assess exposure in their environments.

Recommended defensive actions

• Verify and apply patches for OpenSSL versions 3.0.0 to 3.0.22, 3.4.0 to 3.4.7, 3.5.0 to 3.5.8, 3.6.0 to 3.6.4, and 4.0.0 to 4.0.2
• Assess exposure in environments using OpenSSL CMP servers
• Monitor for unusual CMP activity and cache growth
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The OpenSSL Certificate Management Protocol (CMP) caches additional certificates sent in a CMP message but never expunges them if they are invalid. A malicious client may flood a CMP server with requests driving unbounded growth of the cache of extraCerts, potentially leading to OOM conditions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.