Format string error in OpenSSL - CVE-2026-63073

Vulnerability identifier: #VU145421

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-63073

CWE-ID: CWE-134

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use of externally-controlled format string in OpenSSL CMP response validation when processing an unexpected sender distinguished name. A remote attacker can send a crafted CMP response to cause a denial of service.

This path is reached when the client configures an expected sender or uses a pinned server certificate whose subject becomes the default expected sender.

OpenSSL
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
FreeBSD
Basesystem Module
Ubuntu
openEuler
openssl (Ubuntu package)
libopenssl-3-fips-provider-32bit-debuginfo
libopenssl3-32bit-debuginfo
libopenssl3
openssl-3-debuginfo
openssl-3
libopenssl-3-fips-provider-debuginfo
openssl-3-debugsource
libopenssl3-debuginfo
libopenssl-3-devel
libopenssl-3-fips-provider
libopenssl-3-fips-provider-32bit
libopenssl3-32bit
openssl
openssl-debuginfo
openssl-debugsource
openssl-devel
openssl-libs
openssl-perl
openssl-help
openssl (Debian package)

Install security update from vendor's website.

OpenSSL - addressed in versions 3.4.7, 3.5.8, 3.6.4, 4.0.2
openssl (Ubuntu package) - addressed in versions 3.0.2-0ubuntu1.29, 3.0.13-0ubuntu3.15, 3.5.5-1ubuntu3.4, 3.5.5-1ubuntu3.5
libopenssl-3-fips-provider-32bit-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl3-32bit-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl3 - update to 3.5.0-150700.5.50.1
openssl-3-debuginfo - update to 3.5.0-150700.5.50.1
openssl-3 - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-debuginfo - update to 3.5.0-150700.5.50.1
openssl-3-debugsource - update to 3.5.0-150700.5.50.1
libopenssl3-debuginfo - update to 3.5.0-150700.5.50.1
libopenssl-3-devel - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider - update to 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-32bit - update to 3.5.0-150700.5.50.1
libopenssl3-32bit - update to 3.5.0-150700.5.50.1
openssl - update to 3.5.6-7
openssl-debuginfo - update to 3.5.6-7
openssl-debugsource - update to 3.5.6-7
openssl-devel - update to 3.5.6-7
openssl-libs - update to 3.5.6-7
openssl-perl - update to 3.5.6-7
openssl-help - update to 3.5.6-7
openssl (Debian package) - update to 3.5.7-1~deb13u2

• https://openssl-library.org/news/secadv/20260825.txt

• Multiple vulnerabilities in OpenSSL
• Debian update for openssl
• FreeBSD update for OpenSSL
• Ubuntu update for openssl
• Ubuntu update for openssl
• SUSE update for openssl-3
• openEuler 24.03 LTS SP4 update for openssl