CVE-2026-63074

A flaw was found in OpenSSL. The CMP (Certificate Management Protocol) implementation does not clear cached additional certificates when an invalid message is received, leading to excessive memory consumption. This allows a malicious client to repeatedly send requests containing unique extra certificates to cause memory exhaustion, eventually resulting in a denial of service.

To exploit this flaw, an attacker needs to repeatedly send invalid messages containing additional certificates to a CMP server. However, this issue only affects CMP servers with long-lived context objects. This can grow the extra certificates cache and cause excessive memory consumption, eventually resulting in a denial of service. For these reasons, this vulnerability has been rated with a low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.