CVE-2026-63073

Untrusted Sender DN Used as Format String in CMP Response Validation

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Description
Issue summary: OpenSSL CMP response validation passed an unexpected response
sender distinguished name directly as the format string to `ERR_raise_data()`.

Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client
that enforces an expected sender or uses a pinned server certificate whose
subject becomes the default expected sender.

CWE: CWE-134 (Use of Externally-Controlled Format String)

Description: When validating a received CMP message, ossl_cmp_msg_check_update()
converts the peer-supplied sender distinguished name with X509_NAME_oneline()
and passes it directly as the format argument to ERR_raise_data(). Percent
characters survive the conversion, so a sender DN such as "CN=%s%n" reaches
BIO_vsnprintf() as an attacker-controlled format string with no matching variadic
arguments. This path is only reached when the caller configures an expected
sender or pins a server certificate, which is the normal configuration for a
CMP client validating server responses.

Since the attacker controls the format string but none of the variadic
arguments, such specifiers as %s and %n dereference or write through unrelated
stack contents and crash the client. The reliable consequence is a denial of
service, when the response comes from a malicious or intercepted CMP endpoint.
There is no controlled memory write, arbitrary-address read, or reliable path
to remote code execution.

FIPS impact: no

No FIPS modules are affected by this issue, as the CMP protocol
implementation is outside the OpenSSL FIPS module boundary.

Analysis

AI-generated

Technical impact

The flaw occurs when a CMP client accepts a response with a sender distinguished name that is passed as an uncontrolled format string to ERR_raise_data(). An attacker can craft a DN containing percent sequences such as %s and %n. Because no matching arguments are supplied, BIO_vsnprintf() dereferences or writes to unrelated stack memory, causing the client to crash. This is a classic externally controlled format string weakness (CWE‑134) that leads to denial of service with no possibility of remote code execution or data exposure.

Affected Systems

Affected installations include any OpenSSL build that implements CMP client functionality and is configured to enforce an expected sender DN or to use certificate pinning. Specific version numbers are not provided in the CVE data; the defect has been fixed in the OpenSSL source code merged in several commits (e.g., commit 0cc20b322639919aa423e90799d9a57c3b4b76ca). All projects using OpenSSL CMP components should verify that they run a version that includes those commits.

Risk and Exploitability

The exploit requires control of a CMP endpoint that sends a crafted DN. The attack path is straightforward: the client validates the sender DN, the bug is triggered, and the client crashes, resulting in a denial of service. No privileged escalation or data leak occurs. The CVSS score of 9.8 indicates critical severity, and the EPSS score of <1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting a heightened risk in environments that use CMP validation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OpenSSL to a version that contains the fixed CMP response validation commits (e.g., after the merges shown in the GitHub references).
  • If an immediate patch is not yet available, modify the client configuration to disable expected sender validation or certificate pinning for CMP communications, thereby preventing the sender DN from being treated as a format string.
  • Apply robust input validation to any user‑supplied or peer‑supplied distinguished names before passing them to formatting functions, ensuring no percent‑encoded specifiers reach underlying printf‑style calls.

Generated by OpenCVE AI on August 31, 2026 at 21:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6465-1 openssl security update
Ubuntu USN Ubuntu USN USN-8678-1 OpenSSL vulnerabilities
History
Type Values Removed Values Added
CPEs cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low
Type Values Removed Values Added
First Time appeared Openssl
Openssl openssl
Vendors & Products Openssl
Openssl openssl
Type Values Removed Values Added
Description Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as "CN=%s%n" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.
Title Untrusted Sender DN Used as Format String in CMP Response Validation
Weaknesses CWE-134
References
Weaknesses
  • CWE-134

    Use of Externally-Controlled Format String

Sources

Status
PUBLISHED
Assigner
openssl
Published
Updated
Aug 31, 2026, 7:12 PM
Reserved
Jul 15, 2026, 1:10 PM

View source JSON

Updated
Aug 31, 2026, 7:12 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 1:19 PM
Modified
Sep 11, 2026, 9:16 PM

View source JSON

Severity
Low
Public date
Aug 25, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Aug 31, 2026, 10:00 PM

JSON