Executive brief
OpenSSL is a widely used security library that enables encrypted communications for websites and applications. A vulnerability in its Certificate Management Protocol (CMP) client could allow a malicious server or a 'man-in-the-middle' attacker to crash the application. This results in a denial of service, preventing the application from performing its normal security and communication functions.
Technical details
A NULL pointer dereference exists in the OpenSSL CMP (Certificate Management Protocol) client implementation. The vulnerability is triggered when the client processes a specially crafted CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage. Specifically, if an EncryptedValue structure within the message has a symmAlg field with an algorithm OID but lacks the expected parameters field, the client attempts to dereference a NULL pointer. This results in a process crash (Denial of Service). The issue affects applications processing untrusted CMP/CRMF messages but does not impact the FIPS module as the vulnerable code resides outside the FIPS boundary.
Affected products
- OpenSSL OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, 1.0.2
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://github.com/openssl/security/commit/61a86a8cd73546c9fea916f3d304c1293e05c046
- https://github.com/openssl/security/commit/665d5254083affde9982efca7c41dd01cacc8774
- https://github.com/openssl/security/commit/810b722f772652ad48042bcc7ab07e3414b11d0f
- https://github.com/openssl/security/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873
- https://github.com/openssl/security/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d
- https://openssl-library.org/news/secadv/20260609.txt