cyfenced.com →

[ CVE-2026-75805 · Published 29 Sep 2026 ]

Vulnerability in OpenSSL

CVSS 5.3 EPSS <1%2 agency advisoriesFix available

[ Description ]Official description

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1241

    Multiple vulnerabilities in OpenSSL Translated from French

    Multiple vulnerabilities have been discovered in OpenSSL. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

    CVE-2026-75806CVE-2026-77696CVE-2026-35189+11 more CVEs
  • BSI CERT-BundWID-SEC-2026-3638

    OpenSSL: Multiple vulnerabilities Translated from German

    Risk highCVE-2026-35189CVE-2026-84784CVE-2026-75805+11 more CVEs

[ References ]References