CVE-2026-63073: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-63073 is a format string vulnerability in OpenSSL's Certificate Management Protocol (CMP) response validation that allows an unauthenticated attacker at a malicious or intercepted CMP endpoint to crash a CMP client. The flaw was discovered by Filipe Casal of Trail of Bits in collaboration with OpenAI, with patches merged on August 24, 2026, and publicly disclosed on August 25, 2026. Affected versions include OpenSSL 3.4.0–3.4.6, 3.5.0–3.5.7, 3.6.0–3.6.3, and 4.0.0–4.0.1; versions outside these ranges are unaffected by default. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) per Feedly's estimate, though the primary confirmed impact is denial of service (GitHub Advisory, OpenSSL Advisory).

The root cause is CWE-134 (Use of Externally-Controlled Format String). In ossl_cmp_msg_check_update() within crypto/cmp/cmp_vfy.c, when a received CMP message's sender distinguished name does not match the expected sender, the code converts the peer-supplied DN using X509_NAME_oneline() and passes the resulting string directly as the format argument to ERR_raise_data() — rather than as a %s argument. Because percent characters survive the X509_NAME_oneline() conversion, a crafted sender DN such as CN=%s%n reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments, causing dereferences or writes through unrelated stack contents. This code path is only triggered when the CMP client is configured with an expected sender or a pinned server certificate — the standard configuration for validating CMP server responses. The fix, a one-character change replacing the bare string argument with "%s", str, was applied across all affected branches (OpenSSL Commit 0cc20b3, OpenSSL Commit 6a0acc0).

The reliable consequence of exploitation is a denial of service — the CMP client process crashes due to format string specifiers such as %s and %n dereferencing or writing through unrelated stack contents. OpenSSL's own advisory notes there is no controlled memory write, arbitrary-address read, or reliable path to remote code execution, making the primary impact an availability disruption for PKI infrastructure relying on CMP for certificate lifecycle management. Environments using automated certificate enrollment or renewal via CMP (e.g., in enterprise PKI, IoT provisioning, or network device management) are most at risk, as a compromised or spoofed CMP endpoint could repeatedly crash clients and disrupt certificate issuance workflows (GitHub Advisory, OpenSSL Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as automatable with total technical impact. The EPSS score is approximately 0.93%, reflecting low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Position as malicious or intercepted CMP endpoint: The attacker must control or intercept the CMP server that the target client communicates with — either by operating a rogue CMP server, performing a man-in-the-middle attack (e.g., via DNS spoofing, BGP hijacking, or ARP poisoning on the network path), or compromising a legitimate CMP server.
2. Identify a vulnerable CMP client: Confirm the target CMP client is running an affected OpenSSL version (3.4.0–3.4.6, 3.5.0–3.5.7, 3.6.0–3.6.3, or 4.0.0–4.0.1) and is configured with an expected sender DN or a pinned server certificate — the standard configuration that triggers the vulnerable code path.
3. Craft a malicious CMP response: Construct a CMP response message containing a sender distinguished name with format string specifiers, such as CN=%s%n or CN=%x%x%x%n, which will survive the X509_NAME_oneline() conversion.
4. Deliver the malicious response: Send the crafted CMP response to the client when it initiates a CMP transaction (e.g., certificate request, renewal, or revocation check).
5. Trigger the crash: The client's ossl_cmp_msg_check_update() detects the sender DN mismatch, converts the attacker-controlled DN, and passes it as a format string to ERR_raise_data(), which calls BIO_vsnprintf() with no matching variadic arguments — causing a crash via stack dereference or write (OpenSSL Commit 0cc20b3, GitHub Advisory).

• Network: Unexpected or anomalous CMP traffic (typically HTTP/HTTPS on port 80/443 or custom CMP ports) from unknown or unauthorized endpoints; DNS queries for CMP server hostnames resolving to unexpected IP addresses suggesting DNS spoofing.
• Logs: OpenSSL error log entries referencing CMP_R_UNEXPECTED_SENDER immediately before a process crash; application crash logs or core dumps from processes using OpenSSL CMP functionality; repeated CMP connection attempts from the same source followed by client-side crashes.
• Process: Unexpected termination (segmentation fault or similar) of processes that use OpenSSL's CMP client functionality; core dump files generated by the CMP client process in the working directory or /var/crash/.
• File System: Core dump files (e.g., core, core.<pid>) in the application working directory following CMP transactions with an unexpected sender DN.

OpenSSL has released patched versions addressing this vulnerability: 3.4.7, 3.5.8, 3.6.4, and 4.0.2. Administrators should upgrade to one of these versions as the primary remediation. As a network-level workaround, restrict CMP client connectivity to known, trusted CMP endpoints using firewall rules or network segmentation, and consider implementing DNSSEC validation to prevent DNS-based endpoint spoofing. Downstream distributions including Ubuntu (USN-8678-1, USN-8678-3), FreeBSD (FreeBSD-SA-26:61.openssl), SUSE (SUSE-SU-2026:4039-1), and openSUSE have also released updated packages (OpenSSL Advisory, Ubuntu Advisory, FreeBSD Advisory).

The vulnerability was part of a broader OpenSSL security update in August 2026 that addressed nine vulnerabilities, receiving coverage from security news outlets including CyberSecurityNews and GBHackers, which highlighted the format string flaw alongside heap corruption issues in the same release (CyberSecurityNews, GBHackers). Cryptika and SecureBulletin also covered the update, noting the remote crash and heap memory corruption risks (Cryptika). The original patch was credited to Filipe Casal of Trail of Bits in collaboration with OpenAI, reflecting an emerging trend of AI-assisted vulnerability research in critical open-source cryptographic libraries (OpenSSL Commit 0cc20b3).