CVE-2026-63073: OpenSSL CMP Format String DOS Vulnerability

CVE-2026-63073 Overview

CVE-2026-63073 is a format string vulnerability in the OpenSSL Certificate Management Protocol (CMP) client. The flaw resides in ossl_cmp_msg_check_update(), which passes an attacker-controlled sender distinguished name (DN) directly as the format argument to ERR_raise_data(). A malicious or intercepted CMP endpoint can supply a DN containing format specifiers such as %s or %n, causing BIO_vsnprintf() to dereference unrelated stack contents. The result is a reliable denial of service against CMP clients that enforce an expected sender or pin a server certificate. FIPS modules are not affected because CMP lies outside the OpenSSL FIPS module boundary.

Critical Impact
A malicious or intercepted CMP endpoint can crash any OpenSSL CMP client configured with an expected sender or pinned server certificate, producing a denial of service against certificate enrollment workflows.

Affected Products

OpenSSL builds that include the CMP client implementation in crypto/cmp/cmp_vfy.c
CMP clients configured with an expected sender name or pinned server certificate
Applications and PKI tooling that link against affected OpenSSL versions to perform certificate enrollment

Discovery Timeline

2026-08-25 - CVE-2026-63073 published to the National Vulnerability Database
2026-08-25 - OpenSSL Security Advisory released alongside upstream patch commits
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-63073

Vulnerability Analysis

The vulnerability is a classic Use of Externally-Controlled Format String issue [CWE-134]. When the CMP client validates a received message, it converts the peer-supplied sender DN using X509_NAME_oneline() and forwards the resulting string as the format parameter to ERR_raise_data(). Percent characters in the DN survive the conversion intact and reach BIO_vsnprintf() without matching variadic arguments.

Because the attacker controls only the format string and not the corresponding arguments, specifiers such as %s read from arbitrary stack pointers and %n attempt writes through unrelated stack contents. The reliable outcome is a crash of the client process. The advisory explicitly notes there is no controlled memory write, no arbitrary-address read, and no reliable path to remote code execution.

Root Cause

The root cause is a missing constant format string in the call to ERR_raise_data() inside crypto/cmp/cmp_vfy.c. Passing the DN directly as the format argument violates the standard printf-family safety contract. The vulnerable code path executes only when a caller configures an expected sender or pins a server certificate whose subject becomes the default expected sender, which is the normal configuration for CMP clients validating server responses.

Attack Vector

An attacker operating a malicious CMP server, or an on-path adversary intercepting CMP traffic, returns a response whose sender DN contains crafted format specifiers, for example CN=%s%n. When the client compares the actual sender to the expected sender and detects a mismatch, it invokes the vulnerable error-reporting path and crashes.

// Source: https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca
// crypto/cmp/cmp_vfy.c - upstream fix
                 "expected sender", expected_sender)) {
             str = X509_NAME_oneline(actual_sender, NULL, 0);
             ERR_raise_data(ERR_LIB_CMP, CMP_R_UNEXPECTED_SENDER,
-                str != NULL ? str : "<unknown>");
+                "%s", str != NULL ? str : "<unknown>");
             OPENSSL_free(str);
             return 0;
         }

The patch introduces a constant "%s" format string, ensuring the attacker-controlled DN is treated as a plain argument rather than a format specifier.

Detection Methods for CVE-2026-63073

Indicators of Compromise

Repeated crashes or segmentation faults in processes that invoke OpenSSL CMP client functions during certificate enrollment or renewal
CMP responses whose sender DN fields contain percent characters or printf-style specifiers such as %s, %n, or %x
Unexpected TLS or TCP terminations against CMP endpoints followed by process restart events on the client host

Detection Strategies

Inspect CMP traffic at the network boundary for sender DN values containing % characters, which are not required in legitimate X.509 name components
Correlate application crash telemetry with recent outbound CMP sessions to identify clients receiving malicious responses
Audit software inventory to enumerate binaries and container images statically or dynamically linked against affected OpenSSL versions

Monitoring Recommendations

Enable core-dump collection and centralized crash reporting for services performing certificate enrollment through CMP
Log CMP client errors that reference CMP_R_UNEXPECTED_SENDER and alert on repeated occurrences from the same peer
Monitor certificate lifecycle tooling for abnormal termination during scheduled renewal windows

How to Mitigate CVE-2026-63073

Immediate Actions Required

Upgrade OpenSSL to the patched release identified in the OpenSSL Security Advisory as soon as builds are available
Restrict CMP client traffic to trusted, authenticated CMP servers reachable only through controlled network paths
Validate that PKI enrollment agents and dependent applications are rebuilt or restarted against the patched OpenSSL libraries

Patch Information

The fix wraps the attacker-controlled DN with a constant "%s" format specifier in ERR_raise_data(). Upstream commits addressing the issue include OpenSSL Commit 0cc20b32, OpenSSL Commit 6a0acc07, OpenSSL Commit 7eb2e3ec, and OpenSSL Commit a7e5a6ee. Refer to the OpenSSL Security Advisory for the authoritative list of affected versions and fixed releases.

Workarounds

Disable the enforcement of an expected sender name and remove pinned server certificates in CMP client configurations until patches are applied, accepting the reduced authentication assurance this implies
Route CMP traffic exclusively through mutually authenticated TLS tunnels to trusted internal PKI infrastructure, preventing exposure to malicious or intercepted endpoints
Temporarily suspend automated CMP-based certificate enrollment on internet-facing hosts until affected OpenSSL binaries are upgraded

bash

# Verify the installed OpenSSL version and locate linked binaries
openssl version -a

# Identify processes on Linux hosts that have loaded the OpenSSL crypto library
lsof 2>/dev/null | grep -E 'libcrypto|libssl'

# After upgrade, restart services that consume CMP for certificate enrollment
systemctl restart <cmp-client-service>