CVE-2026-63074 OpenSSL CVE debrief

Who should care

Defenders responsible for OpenSSL deployments using CMP servers, especially those with long-lived server processes or reused OSSL_CMP_CTX objects, should assess their exposure and consider updates to mitigate potential DoS attacks.

Why it matters

CVE-2026-63074 involves a vulnerability in OpenSSL's CMP implementation that can lead to unbounded memory growth and potential DoS attacks. Defenders should verify exposure, especially in deployments with reused OSSL_CMP_CTX objects, and consider updates to mitigate these risks.

• Potential for Out-of-Memory (OOM) conditions due to unbounded memory growth
• Denial of Service (DoS) attacks through repeated sending of rejected CMP messages with large lists of additional certificates
• Need for verification of OpenSSL versions and configurations to determine exposure
• Potential impact on system stability and performance due to memory exhaustion

Technical summary

The OpenSSL Certificate Management Protocol (CMP) implementation caches additional certificates (extraCerts) sent in CMP messages without properly expunging them, even if the messages are rejected. This can lead to unbounded memory growth in CMP servers that reuse OSSL_CMP_CTX objects, potentially causing Out-of-Memory (OOM) conditions. The issue was addressed by removing added extra certs if the message is rejected.

Defensive priority

Defenders should prioritize verifying exposure in OpenSSL deployments, especially those using CMP servers with reused OSSL_CMP_CTX objects, and assess the need for updates to mitigate potential DoS attacks.

Recommended defensive actions

• Verify OpenSSL version and assess exposure based on used versions and configurations
• Review and update CMP server configurations to prevent unbounded cache growth
• Monitor for unusual memory usage patterns in OpenSSL deployments
• Consider implementing rate limiting for CMP requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue involves the OpenSSL Certificate Management Protocol (CMP) caching additional certificates sent in CMP messages without expunging them, potentially leading to unbounded memory growth and OOM conditions if a malicious client floods a CMP server with requests containing unique extra certificates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.