CVE-2026-63076: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-63076 is a NULL pointer dereference vulnerability in OpenSSL's Certificate Management Protocol (CMP) password-based MAC (PBM) protection verification logic. A remote, unauthenticated attacker can send a crafted CMP message with a malformed protectionAlg parameter to crash applications acting as CMP servers or clients, resulting in a Denial of Service. The vulnerability was disclosed on August 25, 2026, and affects OpenSSL versions 3.0.0–3.0.21, 3.4.0–3.4.6, 3.5.0–3.5.7, 3.6.0–3.6.3, and 4.0.0–4.0.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, OpenSSL SecAdv).

The root cause is classified as CWE-476 (NULL Pointer Dereference) in ossl_cmp_calc_protection() within crypto/cmp/cmp_protect.c. When verifying PBM-protected CMP messages, OpenSSL calls X509_ALGOR_get0() to retrieve the protectionAlg parameter, which returns both the ASN.1 type (pptype) and value pointer (ppval). The vulnerable code only checked that ppval != NULL before casting it to a PBMParameter ASN1_STRING, without validating that pptype == V_ASN1_SEQUENCE. A crafted message can encode the parameter as a BOOLEAN instead of the expected SEQUENCE; because the ASN1_TYPE value union overlays the boolean integer on the pointer field, ppval returns as a bogus non-NULL pointer (e.g., 0xff), which is then dereferenced as an invalid pointer. The fix adds a type check: if (pptype != V_ASN1_SEQUENCE || ppval == NULL) (OpenSSL Commit 37882aa, OpenSSL Commit a17cc8d). No knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable — on the server side via OSSL_CMP_SRV_process_request(), and on the client side during CMP response validation (GitHub Advisory).

Successful exploitation causes the affected application to crash, resulting in a Denial of Service. Both CMP server applications accepting PBM-protected messages and CMP client applications connecting to a malicious or intercepted CMP server are affected. There is no impact on confidentiality or integrity — the vulnerability is limited to availability (GitHub Advisory, OpenSSL SecAdv).

No public proof-of-concept exploit code is known, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is network-exploitable with no authentication or user interaction required, and NVD's SSVC assessment marks it as automatable. The EPSS score is approximately 0.0133 (1.33%), indicating a relatively low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been reported (Feedly).

1. Identify target: Locate applications acting as CMP servers or clients using a vulnerable OpenSSL version (3.0.x < 3.0.22, 3.4.x < 3.4.7, 3.5.x < 3.5.8, 3.6.x < 3.6.4, or 4.0.x < 4.0.2) that accept PBM-protected CMP messages.
2. Craft malformed CMP message: Construct a CMP message where the protectionAlg field uses the id-PasswordBasedMAC OID but encodes the algorithm parameter as an ASN.1 BOOLEAN (or other non-SEQUENCE type) instead of the expected PBMParameter SEQUENCE.
3. Send crafted message: Transmit the malformed CMP message to the target CMP server's listening endpoint, or position as a man-in-the-middle to deliver it to a CMP client during response validation.
4. Trigger crash: The vulnerable ossl_cmp_calc_protection() function dereferences the bogus non-NULL pointer (e.g., 0xff) returned by X509_ALGOR_get0(), causing a NULL/invalid pointer dereference and crashing the application process (OpenSSL Commit 37882aa, GitHub Advisory).

• Logs: Unexpected application crashes or segmentation faults in processes using OpenSSL's CMP functionality; error log entries referencing CMP_R_ERROR_CALCULATING_PROTECTION or crashes in ossl_cmp_calc_protection().
• Network: Anomalous CMP protocol traffic containing protectionAlg parameters with unexpected ASN.1 types (e.g., BOOLEAN where a SEQUENCE is expected); repeated CMP connection attempts from a single source followed by server process termination.
• Process: Sudden termination of CMP server or client processes without graceful shutdown; core dump files generated by the OpenSSL-linked application in the working directory.

Upgrade OpenSSL to a patched version: 3.0.22, 3.4.7, 3.5.8, 3.6.4, or 4.0.2 (OpenSSL SecAdv, OpenSSL Release 3.6.4). Downstream distributions including Ubuntu (USN-8678-1, USN-8678-3), SUSE (SUSE-SU-2026:3876-1, SUSE-SU-2026:4032-1, SUSE-SU-2026:4040-1), FreeBSD (FreeBSD-SA-26:61.openssl), and openSUSE have released updated packages. If immediate patching is not possible, restrict CMP message processing to trusted network sources, or disable CMP functionality entirely if it is not required by the application (Ubuntu Advisory, FreeBSD Advisory).

The vulnerability was part of a broader OpenSSL security release on August 25, 2026, that patched nine vulnerabilities, receiving coverage from security news outlets including CyberSecurityNews and GBHackers (CyberSecurityNews, GBHackers). Multiple Linux distributions and BSD projects responded quickly with updated packages within days of disclosure. Community reaction was measured, noting the limited scope (DoS only, no code execution) and the low exploitation barrier (no authentication required) as key factors for prioritization (SecureBulletin).