CVE-2026-63073

A flaw was found in OpenSSL. A malicious CMP (Certificate Management Protocol) endpoint can send an unexpected distinguished name (DN) directly as the format string argument to ERR_raise_data(), causing the application to dereference and write to unrelated stack contents. This can lead to a crash in the CMP client, resulting in a denial of service.

Applications acting as a CMP client connecting to a malicious or intercepted CMP server are vulnerable to this issue, limiting its exposure. Also, the CMP client needs to enforce an expected sender or use a pinned server certificate whose subject becomes the default expected sender. This flaw can cause the application to dereference and write to unrelated stack contents, leading to a crash in the CMP client and resulting in a denial of service. There is no controlled memory write, arbitrary-address read or path to code execution. For these reasons, this vulnerability has been rated with a low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.