Read the docs
TI-2026-45028 Aliases CVE-2026-63074GHSA-2q27-mpm9-44m4

CMP Indefinite Cache Growth of ExtraCerts

Priority LOW 27CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 10 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00588 48th percentileScored 2026-11-07
Fix Partial OpenSSL (OpenSSL): 4.0.2, 3.6.4, 3.5.8 +2Red Hat: 12 advisoriesRed Hat: 7 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSSLOpenSSL4.0.0 to before 4.0.2; 3.6.0 to before 3.6.4; 3.5.0 to before 3.5.8; 3.4.0 to before 3.4.7; 3.0.0 to before 3.0.224.0.2, 3.6.4, 3.5.8, 3.4.7, 3.0.22Patch availableCNA
  • OpenSSL VendorOpenSSL Affected 4.0.0 to before 4.0.2; 3.6.0 to before 3.6.4; 3.5.0 to before 3.5.8; 3.4.0 to before 3.4.7; 3.0.0 to before 3.0.22 Fixed in 4.0.2, 3.6.4, 3.5.8, 3.4.7, 3.0.22 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*3.0.0 to before 3.0.22; 3.4.0 to before 3.4.7; 3.5.0 to before 3.5.8; 3.6.0 to before 3.6.4; 4.0.0 to before 4.0.2VulnerableOpenSSL
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.0.22; 3.4.0 to before 3.4.7; 3.5.0 to before 3.5.8; 3.6.0 to before 3.6.4; 4.0.0 to before 4.0.2 Vulnerable ·OpenSSL

Remediation

  • Fix · CNA OpenSSL (OpenSSL) Fixed in 4.0.2, 3.6.4, 3.5.8, 3.4.7, 3.0.22

Red Hat 12 advisories

  • RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
Show 9 more Red Hat advisories
  • RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:71603 Released 2026-09-24 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:67956 Released 2026-09-16 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:67165 Released 2026-09-14 · Red Hat rating Important
    openssl security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.5.8-1.el9_8, openssl-perl-1:3.5.8-1.el9_8
    • Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.5.8-1.el9_8, openssl-libs-1:3.5.8-1.el9_8
  • RHSA-2026:67154 Released 2026-09-14 · Red Hat rating Important
    openssl security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) openssl-devel-1:3.5.8-1.el10_2, openssl-perl-1:3.5.8-1.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) openssl-1:3.5.8-1.el10_2, openssl-libs-1:3.5.8-1.el10_2
  • RHSA-2026:59641 Released 2026-08-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images openssl-1:3.5.8-0.1.hum1@aarch64, openssl-1:3.5.8-0.1.hum1@src, openssl-1:3.5.8-0.1.hum1@x86_64 +12
  • RHSA-2026:59635 Released 2026-08-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images openssl3-1:3.5.8-0.1.hum1@src, openssl3-devel-1:3.5.8-0.1.hum1@aarch64, openssl3-devel-1:3.5.8-0.1.hum1@x86_64 +4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    OpenSSL — openssl-library.org/news/secadv/20260825.txt

    9 records Highest priority Priority MEDIUM 8 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-45027 Untrusted Sender DN Used as Format String in CMP Response ValidationPriority MEDIUM 51
    • TI-2026-53058 AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()Priority MEDIUM 47
    • TI-2026-45030 Invalid Pointer Dereference in CMP Server via Crafted protectionAlgPriority MEDIUM 42
    Show all 9 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat JBoss Core ServicesAffectedNo fix yet: Fix deferred
Red Hat JBoss Web Server 6AffectedNo fix yet: Fix deferred
Red Hat JBoss Web Server 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat Satellite ClientAffectedNo fix yet: Fix deferred
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:67154
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:67165
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:67154
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:67165
Red Hat Hardened ImagesFixed RHSA-2026:59635, RHSA-2026:59641
Red Hat Update Infrastructure 5Fixed RHSA-2026:67956, RHSA-2026:71603
Not affected: 11 products
  • Cert Manager support for Red Hat OpenShift release 1.20
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat Satellite Client
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63074
  2. 2026-10-03 Alias added: GHSA-2q27-mpm9-44m4
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-10-30 Affected versions changed · Red Hat
  5. 2026-11-07 Affected versions changed · Red Hat

References

Patch 5

Advisory 1

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
See all 312 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences