CVE-2026-63074
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches
additional certificates (extraCerts) sent in a CMP message, but never expunges
them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX
frequently, this cache of extraCerts may grow unboundedly, and a malicious
client may flood a CMP server with requests driving this growth.
Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX
for the lifetime of a server process may observe unbounded memory growth in the
event a malicious client repeatedly sends requests containing unique extra
certificates, which may lead to OOM conditions.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: If a remote user sends CMP messages to a server with a list of
extraCerts and the message is rejected, the extraCerts from the message remains
in the server contexts untrusted certificate stack. This exposes servers with
long lived ctx objects to Denial of Service attacks in which an attacker sends
messages intending to be rejected with a large list of additional certificates
repeatedly, forcing the server to store them indefinitely.
The issue was fixed by removing the added extra certs if the message is
rejected, using the same method as when the context is configured to not do
caching at all.
FIPS impact: no
As the CMP code lives outside the FIPS module boundary, no FIPS
modules are affected by this CVE.
CSIRTS triage
- What
- Multiple denial of service vulnerabilities in OpenSSL QUIC and DTLS handling allow remote attackers to exhaust resources or crash the service through malformed packets.
- Who is affected
- Ubuntu 26.04 LTS systems and applications using affected OpenSSL versions with QUIC or DTLS functionality enabled.
- Urgency
- Moderate; allows denial of service but not code execution; no active exploitation reported.
- Action
- Apply the USN-8678-1 OpenSSL security update to affected Ubuntu systems.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-63074
Get an email if CVE-2026-63074 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (3)
- unknownUSN-8678-1: OpenSSL vulnerabilitiesubuntu · 2026-08-25
- mediumCVE-2026-63074: Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificate…nvd · 2026-08-25
- unknownDSA-6465-1 openssl - security updatedebian · 2026-08-25
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-63074)