CVE-2026-63073

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63073", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2026-07-15T13:10:26.188Z", "datePublished": "2026-08-25T12:59:43.356Z", "dateUpdated": "2026-08-31T19:12:54.136Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.2", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.4", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.8", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "3.4.7", "status": "affected", "version": "3.4.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Filipe Casal (Trail of Bits)"}, {"lang": "en", "type": "reporter", "value": "Brandon Luo"}, {"lang": "en", "type": "reporter", "value": "TrendAI Zero Day Initiative"}, {"lang": "en", "type": "remediation developer", "value": "Filipe Casal (Trail of Bits)"}], "datePublic": "2026-08-25T11:36:16.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: OpenSSL CMP response validation passed an unexpected response<br>sender distinguished name directly as the format string to `ERR_raise_data()`.<br><br>Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client<br>that enforces an expected sender or uses a pinned server certificate whose<br>subject becomes the default expected sender.<br><br>CWE: CWE-134 (Use of Externally-Controlled Format String)<br><br>Description: When validating a received CMP message, ossl_cmp_msg_check_update()<br>converts the peer-supplied sender distinguished name with X509_NAME_oneline()<br>and passes it directly as the format argument to ERR_raise_data(). Percent<br>characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches<br>BIO_vsnprintf() as an attacker-controlled format string with no matching variadic<br>arguments. This path is only reached when the caller configures an expected<br>sender or pins a server certificate, which is the normal configuration for a<br>CMP client validating server responses.<br><br>Since the attacker controls the format string but none of the variadic<br>arguments, such specifiers as %s and %n dereference or write through unrelated<br>stack contents and crash the client. The reliable consequence is a denial of<br>service, when the response comes from a malicious or intercepted CMP endpoint.<br>There is no controlled memory write, arbitrary-address read, or reliable path<br>to remote code execution.<br><br>FIPS impact: no<br><br>No FIPS modules are affected by this issue, as the CMP protocol<br>implementation is outside the OpenSSL FIPS module boundary."}], "value": "Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."}], "metrics": [{"format": "other", "other": {"content": {"text": "Low"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-134", "description": "Use of Externally-Controlled Format String", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-08-25T12:59:43.356Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20260825.txt"}, {"name": "4.0.2 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"}, {"name": "3.6.4 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"}, {"name": "3.5.8 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca"}, {"name": "3.4.7 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"}], "source": {"discovery": "UNKNOWN"}, "title": "Untrusted Sender DN Used as Format String in CMP Response Validation", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T19:12:48.434586Z", "id": "CVE-2026-63073", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T19:12:54.136Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-63073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-31T19:12:48.434586Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T19:12:32.854Z"}}], "cna": {"title": "Untrusted Sender DN Used as Format String in CMP Response Validation", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Filipe Casal (Trail of Bits)"}, {"lang": "en", "type": "reporter", "value": "Brandon Luo"}, {"lang": "en", "type": "reporter", "value": "TrendAI Zero Day Initiative"}, {"lang": "en", "type": "remediation developer", "value": "Filipe Casal (Trail of Bits)"}], "metrics": [{"other": {"type": "https://openssl-library.org/policies/general/security-policy/", "content": {"text": "Low"}}, "format": "other"}], "affected": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.2", "versionType": "semver"}, {"status": "affected", "version": "3.6.0", "lessThan": "3.6.4", "versionType": "semver"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.8", "versionType": "semver"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-25T11:36:16.000Z", "references": [{"url": "https://openssl-library.org/news/secadv/20260825.txt", "name": "OpenSSL Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21", "name": "4.0.2 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29", "name": "3.6.4 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca", "name": "3.5.8 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4", "name": "3.4.7 git commit", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary.", "supportingMedia": [{"type": "text/html", "value": "Issue summary: OpenSSL CMP response validation passed an unexpected response<br>sender distinguished name directly as the format string to `ERR_raise_data()`.<br><br>Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client<br>that enforces an expected sender or uses a pinned server certificate whose<br>subject becomes the default expected sender.<br><br>CWE: CWE-134 (Use of Externally-Controlled Format String)<br><br>Description: When validating a received CMP message, ossl_cmp_msg_check_update()<br>converts the peer-supplied sender distinguished name with X509_NAME_oneline()<br>and passes it directly as the format argument to ERR_raise_data(). Percent<br>characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches<br>BIO_vsnprintf() as an attacker-controlled format string with no matching variadic<br>arguments. This path is only reached when the caller configures an expected<br>sender or pins a server certificate, which is the normal configuration for a<br>CMP client validating server responses.<br><br>Since the attacker controls the format string but none of the variadic<br>arguments, such specifiers as %s and %n dereference or write through unrelated<br>stack contents and crash the client. The reliable consequence is a denial of<br>service, when the response comes from a malicious or intercepted CMP endpoint.<br>There is no controlled memory write, arbitrary-address read, or reliable path<br>to remote code execution.<br><br>FIPS impact: no<br><br>No FIPS modules are affected by this issue, as the CMP protocol<br>implementation is outside the OpenSSL FIPS module boundary.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-134", "description": "Use of Externally-Controlled Format String"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-08-25T12:59:43.356Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63073", "state": "PUBLISHED", "dateUpdated": "2026-08-31T19:12:54.136Z", "dateReserved": "2026-07-15T13:10:26.188Z", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "datePublished": "2026-08-25T12:59:43.356Z", "assignerShortName": "openssl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.2", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.4", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.8", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "3.4.7", "status": "affected", "version": "3.4.0", "versionType": "semver"}]}], "source": "openssl-security@openssl.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "216D6529-561A-4684-A886-50954FBEBFB2", "versionEndExcluding": "3.4.7", "versionStartIncluding": "3.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5BB9E95-09B6-4163-B51C-D62B528A04DA", "versionEndExcluding": "3.5.8", "versionStartIncluding": "3.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1416826-F2F1-4EA8-9FB2-A56B0DA923C1", "versionEndExcluding": "3.6.4", "versionStartIncluding": "3.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "63B8F45B-E44F-481C-815D-AF9CA89C48F6", "versionEndExcluding": "4.0.2", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."}], "id": "CVE-2026-63073", "lastModified": "2026-09-11T21:16:45.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63073", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-31T19:12:48.434586Z", "version": "2.0.3"}}]}, "published": "2026-08-25T13:19:26.147", "references": [{"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"}, {"source": "openssl-security@openssl.org", "tags": ["Vendor Advisory"], "url": "https://openssl-library.org/news/secadv/20260825.txt"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "openssl-security@openssl.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openssl: untrusted sender DN used as format string in CMP response validation", "id": "2517565", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517565"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-134", "details": ["A flaw was found in OpenSSL. A malicious CMP (Certificate Management Protocol) endpoint can send an unexpected distinguished name (DN) directly as the format string argument to ERR_raise_data(), causing the application to dereference and write to unrelated stack contents. This can lead to a crash in the CMP client, resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-63073", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "ovmf", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "shim-signed", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "compat-openssl10", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mingw-openssl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "compat-openssl11", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openssl3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "unbound", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:rhel_satellite_client:6::el7", "fix_state": "Not affected", "package_name": "openvox-agent", "product_name": "Red Hat Satellite Client"}, {"cpe": "cpe:/a:redhat:rhel_satellite_client:6::el7", "fix_state": "Not affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite Client"}], "public_date": "2026-08-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63073\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63073\nhttps://openssl-library.org/news/secadv/20260825.txt"], "statement": "Applications acting as a CMP client connecting to a malicious or intercepted CMP server are vulnerable to this issue, limiting its exposure. Also, the CMP client needs to enforce an expected sender or use a pinned server certificate whose subject becomes the default expected sender. This flaw can cause the application to dereference and write to unrelated stack contents, leading to a crash in the CMP client and resulting in a denial of service. There is no controlled memory write, arbitrary-address read or path to code execution. For these reasons, this vulnerability has been rated with a low severity.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0,3.6.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenSSL", "source": "cna", "vendor": "OpenSSL"}, "product": "openssl", "vendor": "openssl"}], "created": "2026-08-25T14:45:03.808280+00:00", "updated": "2026-08-31T22:00:06.141956+00:00", "vendors": ["openssl", "openssl$PRODUCT$openssl"]}