Allocation of Resources Without Limits or Throttling in OpenSSL - CVE-2026-63074
Published: August 26, 2026
Vulnerability identifier: #VU145422
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63074
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in OpenSSL CMP extraCerts caching when processing rejected CMP messages containing additional certificates. A remote user can repeatedly send CMP requests with unique extra certificates to cause a denial of service.
The issue affects servers that reuse a single OSSL_CMP_CTX for the lifetime of the server process, allowing the untrusted certificate stack to grow without being expunged after message rejection.
Affected software
OpenSSL
Debian Linux
FreeBSD
openssl (Debian package)
Debian Linux
FreeBSD
openssl (Debian package)
How to mitigate CVE-2026-63074
Install security update from vendor's website.
OpenSSL - addressed in versions 3.0.22, 3.4.7, 3.5.8, 3.6.4, 4.0.2
openssl (Debian package) - update to 3.5.7-1~deb13u2
openssl (Debian package) - update to 3.5.7-1~deb13u2