CVE-2026-63076

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63076", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2026-07-15T13:10:26.188Z", "datePublished": "2026-08-25T13:00:11.218Z", "dateUpdated": "2026-08-25T14:37:32.193Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.2", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.4", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.8", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "3.4.7", "status": "affected", "version": "3.4.0", "versionType": "semver"}, {"lessThan": "3.0.22", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Ying Dong"}, {"lang": "en", "type": "reporter", "value": "Bhabani Sankar Das"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Kubec"}], "datePublic": "2026-08-25T11:36:16.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: OpenSSL CMP password based protection verification only<br>checks whether the protectionAlg parameter was not NULL and not its<br>ASN.1 type, before treating it as a PBMParameter. A crafted message can<br>contain a parameter of a different type, which is then dereferenced as an<br>invalid pointer.<br><br>Impact summary: A remote, unauthenticated attacker can crash an application<br>acting as a CMP server that accepts PBM-protected messages, or a CMP client<br>talking to a malicious or intercepted CMP server, resulting in a Denial of<br>Service.<br><br>CWE: CWE-476: NULL Pointer Dereference<br><br>Description: When verifying the password-based MAC protection of a CMP<br>message, OpenSSL library reads the protectionAlg algorithm parameter with<br>X509_ALGOR_get0(), which returns both the parameter type and its value<br>pointer. The value is then cast to an ASN1_STRING and treated as the<br>expected PBMParameter after only checking that pointer is not NULL. The<br>parameter type returned by X509_ALGOR_get0() was never consulted.<br><br>This happens during protection verification, before any MAC is computed, so<br>no knowledge of the PBM shared secret is required; the only precondition is<br>that PBM verification is reachable. On the server side this is reached from<br>OSSL_CMP_SRV_process_request() for any application that stands up a CMP<br>server accepting PBM-protected messages, and on the client side from CMP<br>response validation against a malicious or on-path (MITM) server. The<br>reliable consequence is a denial of service; there is no memory disclosure,<br>no controlled memory write, and no path to code execution. CMP is a<br>specialized feature that an application must explicitly enable.<br><br>FIPS impact: no<br>As the CMP code lives outside the FIPS module boundary, no FIPS modules<br>are affected by this CVE."}], "value": "Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}], "metrics": [{"format": "other", "other": {"content": {"text": "Moderate"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-08-25T13:00:11.218Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20260825.txt"}, {"name": "4.0.2 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e"}, {"name": "3.6.4 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226"}, {"name": "3.5.8 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c"}, {"name": "3.4.7 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259"}, {"name": "3.0.22 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b"}], "source": {"discovery": "UNKNOWN"}, "title": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T14:37:28.943884Z", "id": "CVE-2026-63076", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:37:32.193Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-63076", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:37:28.943884Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T14:37:23.862Z"}}], "cna": {"title": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Ying Dong"}, {"lang": "en", "type": "reporter", "value": "Bhabani Sankar Das"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Kubec"}], "metrics": [{"other": {"type": "https://openssl-library.org/policies/general/security-policy/", "content": {"text": "Moderate"}}, "format": "other"}], "affected": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.2", "versionType": "semver"}, {"status": "affected", "version": "3.6.0", "lessThan": "3.6.4", "versionType": "semver"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.8", "versionType": "semver"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.7", "versionType": "semver"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.22", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-25T11:36:16.000Z", "references": [{"url": "https://openssl-library.org/news/secadv/20260825.txt", "name": "OpenSSL Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e", "name": "4.0.2 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226", "name": "3.6.4 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c", "name": "3.5.8 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259", "name": "3.4.7 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b", "name": "3.0.22 git commit", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE.", "supportingMedia": [{"type": "text/html", "value": "Issue summary: OpenSSL CMP password based protection verification only<br>checks whether the protectionAlg parameter was not NULL and not its<br>ASN.1 type, before treating it as a PBMParameter. A crafted message can<br>contain a parameter of a different type, which is then dereferenced as an<br>invalid pointer.<br><br>Impact summary: A remote, unauthenticated attacker can crash an application<br>acting as a CMP server that accepts PBM-protected messages, or a CMP client<br>talking to a malicious or intercepted CMP server, resulting in a Denial of<br>Service.<br><br>CWE: CWE-476: NULL Pointer Dereference<br><br>Description: When verifying the password-based MAC protection of a CMP<br>message, OpenSSL library reads the protectionAlg algorithm parameter with<br>X509_ALGOR_get0(), which returns both the parameter type and its value<br>pointer. The value is then cast to an ASN1_STRING and treated as the<br>expected PBMParameter after only checking that pointer is not NULL. The<br>parameter type returned by X509_ALGOR_get0() was never consulted.<br><br>This happens during protection verification, before any MAC is computed, so<br>no knowledge of the PBM shared secret is required; the only precondition is<br>that PBM verification is reachable. On the server side this is reached from<br>OSSL_CMP_SRV_process_request() for any application that stands up a CMP<br>server accepting PBM-protected messages, and on the client side from CMP<br>response validation against a malicious or on-path (MITM) server. The<br>reliable consequence is a denial of service; there is no memory disclosure,<br>no controlled memory write, and no path to code execution. CMP is a<br>specialized feature that an application must explicitly enable.<br><br>FIPS impact: no<br>As the CMP code lives outside the FIPS module boundary, no FIPS modules<br>are affected by this CVE.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-08-25T13:00:11.218Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63076", "state": "PUBLISHED", "dateUpdated": "2026-08-25T14:37:32.193Z", "dateReserved": "2026-07-15T13:10:26.188Z", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "datePublished": "2026-08-25T13:00:11.218Z", "assignerShortName": "openssl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.2", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.4", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"lessThan": "3.5.8", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "3.4.7", "status": "affected", "version": "3.4.0", "versionType": "semver"}, {"lessThan": "3.0.22", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "openssl-security@openssl.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DAAFBD8-3DEE-4F6B-8D83-02966005168A", "versionEndExcluding": "3.0.22", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "216D6529-561A-4684-A886-50954FBEBFB2", "versionEndExcluding": "3.4.7", "versionStartIncluding": "3.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5BB9E95-09B6-4163-B51C-D62B528A04DA", "versionEndExcluding": "3.5.8", "versionStartIncluding": "3.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1416826-F2F1-4EA8-9FB2-A56B0DA923C1", "versionEndExcluding": "3.6.4", "versionStartIncluding": "3.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "63B8F45B-E44F-481C-815D-AF9CA89C48F6", "versionEndExcluding": "4.0.2", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}], "id": "CVE-2026-63076", "lastModified": "2026-09-11T21:17:12.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63076", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T14:37:28.943884Z", "version": "2.0.3"}}]}, "published": "2026-08-25T13:19:26.543", "references": [{"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c"}, {"source": "openssl-security@openssl.org", "tags": ["Vendor Advisory"], "url": "https://openssl-library.org/news/secadv/20260825.txt"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "openssl-security@openssl.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "id": "2517561", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517561"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-63076", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "ovmf", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "shim-signed", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "compat-openssl10", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mingw-openssl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "compat-openssl11", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "shim", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "shim-unsigned-aarch64", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "shim-unsigned-x64", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "openssl3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "unbound", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:rhel_satellite_client:6::el7", "fix_state": "Affected", "package_name": "openvox-agent", "product_name": "Red Hat Satellite Client"}, {"cpe": "cpe:/a:redhat:rhel_satellite_client:6::el7", "fix_state": "Not affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite Client"}], "public_date": "2026-08-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63076\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63076\nhttps://openssl-library.org/news/secadv/20260825.txt"], "statement": "To exploit this issue, an attacker needs to supply a crafted CMP message to an application acting as a CMP server or client. Server applications need to be configured to accept PBM-protected messages, and client applications need to communicate with a malicious or intercepted CMP server. The missing type check causes an invalid pointer dereference, resulting in a denial of service. There is no memory disclosure, no controlled memory write, and no path to code execution. For these reasons, this vulnerability has been rated with a moderate severity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0,3.6.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.5.0,3.5.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.4.0,3.4.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.22)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenSSL", "source": "cna", "vendor": "OpenSSL"}, "product": "openssl", "vendor": "openssl"}], "created": "2026-08-25T14:45:03.807080+00:00", "updated": "2026-08-26T14:45:04.315408+00:00", "vendors": ["openssl", "openssl$PRODUCT$openssl"]}