CVE-2026-63073: Untrusted Sender DN Used as Format String in CMP Response Validation
Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u8Fixed in 3.0.20-1~deb12u2
Event History
Frequently Asked Questions
Which CMP deployments are exposed to this issue?
CMP clients that validate server responses by configuring an expected sender are exposed. Clients that pin a server certificate are also exposed because its subject becomes the default expected sender.
What does an attacker need to trigger the failure?
An attacker needs to control a CMP response sender distinguished name, such as by operating a malicious CMP endpoint or intercepting CMP traffic. The vulnerable validation path is reached when that sender is unexpected relative to the configured or default expected sender.
Are CMP clients affected in a typical validating configuration?
Yes. Enforcing an expected sender, including through a pinned server certificate, is described as the normal configuration for a CMP client validating server responses.
What observable effect should responders expect from exploitation?
A sender DN containing format specifiers such as %s or %n can cause the client to dereference or write through unrelated stack contents and crash. The issue affects response validation rather than ordinary processing of trusted sender data.