CVE-2026-63074: CMP Indefinite Cache Growth of ExtraCerts
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth.
Affected Software
Event History
Frequently Asked Questions
Which CMP server deployments are exposed to this denial-of-service condition?
Servers that reuse a single OSSL_CMP_CTX for the lifetime of the server process are exposed. The risk is unbounded memory growth when that long-lived context retains certificates from repeated requests.
What does an attacker need to do to trigger memory growth?
A remote attacker must repeatedly send CMP messages containing unique additional certificates (extraCerts), with messages intended to be rejected. The rejected messages leave their extraCerts in the server context's untrusted certificate stack.
What is the practical impact of exploitation?
Repeated requests can cause the extraCerts cache to grow indefinitely, consuming process memory. This can eventually lead to an out-of-memory condition and denial of service.
Is a server affected if it does not keep an OSSL_CMP_CTX for a long time?
The described exposure is specifically for servers with long-lived context objects, particularly one OSSL_CMP_CTX reused for the process lifetime. The provided information does not identify short-lived or non-reused contexts as affected.