CVE-2026-63074: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-63074 is a Denial of Service vulnerability in OpenSSL's Certificate Management Protocol (CMP) implementation caused by unbounded growth of a cached extraCerts stack. When a CMP server reuses a single OSSL_CMP_CTX object across its lifetime, rejected CMP messages still have their extraCerts retained in the server's untrusted certificate stack indefinitely, allowing a malicious client to exhaust server memory. Affected OpenSSL versions include 3.0.0–3.0.21, 3.4.0–3.4.6, 3.5.0–3.5.7, 3.6.0–3.6.3, and 4.0.0–4.0.1. The vulnerability was disclosed on August 25, 2026, and carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, OpenSSL Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In the ossl_cmp_msg_check_update() function within crypto/cmp/cmp_vfy.c, OpenSSL prepends extraCerts from incoming CMP messages to the context's untrusted certificate stack (ctx->untrusted) before validating the message. Prior to the fix, if message validation failed and the message was rejected, the added certificates were only removed when ctx->noCacheExtraCerts was set — not on validation failure. This meant that an attacker could repeatedly send intentionally invalid CMP messages containing large lists of unique certificates, each of which would be permanently retained in the stack, causing unbounded memory growth. The fix modifies the condition to also remove added certificates when validation fails (res != 1), regardless of the caching configuration (OpenSSL Commit, OpenSSL Commit).

Successful exploitation results in an out-of-memory (OOM) condition on the targeted CMP server, causing a crash or severe degradation of availability. There is no impact on confidentiality or integrity — the vulnerability is purely a Denial of Service. Only servers that reuse a single OSSL_CMP_CTX for the lifetime of the server process are vulnerable; servers that create a fresh context per connection are not affected. FIPS modules are not impacted, as the CMP code resides outside the FIPS module boundary (OpenSSL Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.49%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity (AC:H) as the attacker must be able to reach the CMP server endpoint and send repeated crafted messages, but no authentication or user interaction is required (GitHub Advisory, OpenSSL Advisory).

1. Reconnaissance: Identify CMP servers running vulnerable OpenSSL versions (3.0.0–3.0.21, 3.4.0–3.4.6, 3.5.0–3.5.7, 3.6.0–3.6.3, or 4.0.0–4.0.1) that expose a CMP endpoint and reuse a long-lived OSSL_CMP_CTX object.
2. Craft malicious CMP messages: Construct CMP messages that will be rejected by the server (e.g., messages with invalid or missing protection), each containing a large list of unique extraCerts (certificates not previously seen by the server).
3. Flood the server: Repeatedly send these crafted CMP messages to the server's CMP endpoint at high volume. Each rejected message causes its extraCerts to be permanently added to the server's untrusted certificate stack.
4. Trigger OOM condition: As the untrusted certificate stack grows without bound, the server process exhausts available memory, eventually crashing or becoming unresponsive, achieving a Denial of Service (OpenSSL Commit, OpenSSL Advisory).

• Network: High volume of CMP protocol requests (typically over TCP port 80 or 8080 for HTTP-based CMP, or port 443 for HTTPS) from a single or rotating set of source IPs; requests containing large extraCerts fields that are consistently rejected by the server.
• Logs: OpenSSL CMP server logs showing repeated CMP_R_ERROR_VALIDATING_PROTECTION or CMP_R_MISSING_PROTECTION errors from the same or rotating client addresses; unusually high rate of rejected CMP messages.
• Process/System: Steadily increasing memory consumption of the CMP server process over time without corresponding legitimate traffic growth; OOM killer events in system logs (dmesg or /var/log/syslog) referencing the CMP server process; server crashes or restarts.

OpenSSL has released patched versions addressing this vulnerability: 3.0.22, 3.4.7, 3.5.8, 3.6.4, and 4.0.2. Upgrading to one of these versions is the primary recommended remediation. As interim workarounds if patching is delayed: implement rate limiting on CMP endpoint access, restrict CMP server access to trusted clients only via network-level controls (firewall rules or mTLS), or configure the CMP server to create a fresh OSSL_CMP_CTX per connection rather than reusing a long-lived context. Microsoft has also released patches for affected Azure Linux 3 packages (azl3_openssl_3.3.7-4 and azl3_edk2) (OpenSSL Advisory, Microsoft MSRC, GitHub Advisory).

The vulnerability was part of a broader OpenSSL security advisory on August 25, 2026, that addressed nine vulnerabilities, receiving coverage from security news outlets including CyberSecurityNews and GBHackers (CyberSecurityNews, GBHackers). Multiple Linux distributions including Ubuntu, SUSE, openSUSE, FreeBSD, Slackware, Alpine, and Debian issued their own security advisories and updated packages promptly following the disclosure (Ubuntu Advisory, FreeBSD Advisory, SUSE Advisory). Community reaction was measured, consistent with the Medium severity rating and absence of active exploitation.