CVE-2026-63076: OpenSSL CMP NULL Pointer DoS Vulnerability

CVE-2026-63076 Overview

CVE-2026-63076 is a NULL pointer dereference vulnerability in the OpenSSL Certificate Management Protocol (CMP) implementation. The flaw resides in password-based MAC (PBM) protection verification, where OpenSSL only checks that the protectionAlg parameter pointer is non-NULL without validating its ASN.1 type. A crafted CMP message can supply a parameter of an unexpected type, which the library then dereferences as an invalid PBMParameter pointer.

A remote, unauthenticated attacker can trigger the crash against any application acting as a CMP server that accepts PBM-protected messages, or against a CMP client communicating with a malicious or intercepted server. The reliable outcome is denial of service.

Critical Impact
Remote unauthenticated attackers can crash any OpenSSL-based CMP server or client accepting PBM-protected messages, without knowledge of the shared secret.

Affected Products

OpenSSL versions with CMP support enabled prior to the August 2026 security patches
Applications invoking OSSL_CMP_SRV_process_request() to accept PBM-protected CMP messages
CMP client applications validating responses from remote CMP servers

Discovery Timeline

2026-08-25 - CVE-2026-63076 published to the National Vulnerability Database (NVD)
2026-08-25 - OpenSSL Security Advisory released (OpenSSL Security Advisory August 2026)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-63076

Vulnerability Analysis

The vulnerability is a NULL pointer dereference (CWE-476) in OpenSSL's CMP protection verification path. When verifying the password-based MAC protection of a CMP message, OpenSSL calls X509_ALGOR_get0() to read the protectionAlg algorithm parameter. This function returns both the parameter type (pptype) and its value pointer (ppval).

The defective code path checks only that ppval is not NULL. It then casts the value to an ASN1_STRING and treats it as the expected PBMParameter structure. The pptype field returned by X509_ALGOR_get0() is never consulted before the cast occurs.

This verification runs before any MAC computation, so the attacker needs no knowledge of the PBM shared secret. The only precondition is that PBM verification is reachable, which occurs in any application that explicitly enables CMP. The outcome is limited to a process crash — there is no memory disclosure, no controlled write primitive, and no path to code execution.

Root Cause

The root cause is missing ASN.1 type validation in crypto/cmp/cmp_protect.c. The ossl_cmp_calc_protection() function accepts any non-NULL parameter value and interprets it as V_ASN1_SEQUENCE regardless of the actual encoded type. When an attacker supplies a primitive type such as an integer or octet string, the subsequent structure dereference reads through an invalid pointer and crashes the process.

Attack Vector

An attacker sends a crafted CMP message with a protectionAlg field whose OID identifies password-based MAC but whose parameters use an unexpected ASN.1 type. On the server side, the crash is reached from OSSL_CMP_SRV_process_request(). On the client side, a malicious or on-path (MITM) CMP server can return a poisoned response to crash the client during response validation. CMP is a specialized feature and must be explicitly enabled by the application.

            ERR_raise(ERR_LIB_CMP, CMP_R_MISSING_PBM_SECRET);
            return NULL;
        }
-        if (ppval == NULL) {
+        if (pptype != V_ASN1_SEQUENCE || ppval == NULL) {
            ERR_raise(ERR_LIB_CMP, CMP_R_ERROR_CALCULATING_PROTECTION);
            return NULL;
        }

Source: OpenSSL Commit 37882aa. The patch adds an explicit pptype != V_ASN1_SEQUENCE check to reject non-sequence parameters before dereference.

Detection Methods for CVE-2026-63076

Indicators of Compromise

Unexpected process crashes or segmentation faults in applications linked against a vulnerable OpenSSL and handling CMP traffic
Core dumps referencing ossl_cmp_calc_protection or crypto/cmp/cmp_protect.c on the call stack
Repeated inbound connections to CMP service ports (commonly TCP/80, TCP/443, or custom) followed by service termination

Detection Strategies

Inspect CMP protectionAlg fields at the network boundary and alert when the algorithm OID indicates PBM but the parameter is not an ASN.1 SEQUENCE
Correlate application crash telemetry with preceding inbound CMP messages to identify exploitation attempts
Perform software composition analysis (SCA) on build artifacts to enumerate OpenSSL versions and CMP linkage

Monitoring Recommendations

Enable verbose logging on CMP endpoints to record incoming message metadata and source addresses
Monitor for abnormal restart cycles of CMP-enabled services such as certificate enrollment gateways
Track outbound CMP client sessions and flag those terminating with unexpected TLS or transport resets

How to Mitigate CVE-2026-63076

Immediate Actions Required

Apply the OpenSSL security update referenced in the OpenSSL Security Advisory August 2026 to all affected systems
Inventory applications that explicitly enable CMP and prioritize patching for internet-facing CMP servers
Restrict inbound access to CMP endpoints to trusted management networks until patches are deployed

Patch Information

OpenSSL has released fixes across supported branches. The commits add ASN.1 type validation in ossl_cmp_calc_protection() before dereferencing the parameter value. Relevant fixes are available at Commit 37882aa, Commit a17cc8d6, Commit a1f348cc, Commit a7af46a9, and Commit cdacfff5. FIPS modules are not affected because CMP resides outside the FIPS module boundary.

Workarounds

Disable CMP functionality in applications that do not require certificate management over CMP
Reject PBM-protected messages at an application-layer proxy when the shared secret is not in active use
Constrain CMP client trust to explicitly authenticated servers to reduce MITM exposure

bash

# Verify installed OpenSSL version and check for CMP linkage
openssl version -a
ldd /path/to/application | grep -i ssl

# Restrict inbound CMP traffic to management subnet (iptables example)
iptables -A INPUT -p tcp --dport 829 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 829 -j DROP