Allocation of Resources Without Limits or Throttling in OpenSSL - CVE-2026-63074

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU145422

Allocation of Resources Without Limits or Throttling in OpenSSL - CVE-2026-63074

Published: August 26, 2026


Vulnerability identifier: #VU145422
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63074
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in OpenSSL CMP extraCerts caching when processing rejected CMP messages containing additional certificates. A remote user can repeatedly send CMP requests with unique extra certificates to cause a denial of service.

The issue affects servers that reuse a single OSSL_CMP_CTX for the lifetime of the server process, allowing the untrusted certificate stack to grow without being expunged after message rejection.


Affected software

OpenSSL
Debian Linux
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
IBM i
FreeBSD
Basesystem Module
openSUSE Leap
Ubuntu
Anolis OS
openEuler
openssl (Ubuntu package)
libopenssl3-64bit
libopenssl3-debuginfo
openssl-3-debugsource
libopenssl3
openssl-3
openssl-3-debuginfo
libopenssl-3-devel
libopenssl3-32bit
libopenssl3-32bit-debuginfo
libopenssl-3-devel-32bit
libopenssl-3-devel-64bit
libopenssl3-64bit-debuginfo
openssl-3-doc
openssl
openssl-devel
openssl-libs
openssl-perl
openssl-doc
openssl-debugsource
openssl-debuginfo
openssl-help
libopenssl-3-fips-provider-32bit
libopenssl-3-fips-provider-debuginfo
libopenssl-3-fips-provider
libopenssl-3-fips-provider-64bit
libopenssl-3-fips-provider-64bit-debuginfo
libopenssl-3-fips-provider-32bit-debuginfo
openssl (Debian package)

How to mitigate CVE-2026-63074

Install security update from vendor's website.

OpenSSL - addressed in versions 3.0.22, 3.4.7, 3.5.8, 3.6.4, 4.0.2
openssl (Ubuntu package) - addressed in versions 3.0.2-0ubuntu1.29, 3.0.13-0ubuntu3.15, 3.5.5-1ubuntu3.4, 3.5.5-1ubuntu3.5
libopenssl3-64bit - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1
libopenssl3-debuginfo - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
openssl-3-debugsource - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
libopenssl3 - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
openssl-3 - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
openssl-3-debuginfo - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
libopenssl-3-devel - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
libopenssl3-32bit - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
libopenssl3-32bit-debuginfo - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
libopenssl-3-devel-32bit - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1
libopenssl-3-devel-64bit - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1
libopenssl3-64bit-debuginfo - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1
openssl-3-doc - addressed in versions 3.0.8-150400.4.98.1, 3.0.8-150500.5.75.1, 3.1.4-150600.5.64.1
openssl - update to 3.0.12-31
openssl-devel - update to 3.0.12-31
openssl-libs - update to 3.0.12-31
openssl-perl - update to 3.0.12-31
openssl-doc - update to 3.0.12-31
openssl-debugsource - addressed in versions 3.0.12-53, 3.5.6-7
openssl-debuginfo - addressed in versions 3.0.12-53, 3.5.6-7
openssl-help - addressed in versions 3.0.12-53, 3.5.6-7
openssl - addressed in versions 3.0.12-53, 3.5.6-7
openssl-perl - addressed in versions 3.0.12-53, 3.5.6-7
openssl-devel - addressed in versions 3.0.12-53, 3.5.6-7
openssl-libs - addressed in versions 3.0.12-53, 3.5.6-7
libopenssl-3-fips-provider-32bit - addressed in versions 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-debuginfo - addressed in versions 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
libopenssl-3-fips-provider - addressed in versions 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
libopenssl-3-fips-provider-64bit - update to 3.1.4-150600.5.64.1
libopenssl-3-fips-provider-64bit-debuginfo - update to 3.1.4-150600.5.64.1
libopenssl-3-fips-provider-32bit-debuginfo - addressed in versions 3.1.4-150600.5.64.1, 3.5.0-150700.5.50.1
openssl (Debian package) - update to 3.5.7-1~deb13u2

External References

Related Security Bulletins