OpenSSL’s Certificate Management Protocol implementation caches certificates provided in the extraCerts field of a CMP message but never clears them, even when the message is rejected. The result is that repeated requests containing unique extra certificates can cause a server’s memory usage to grow without bound, potentially exhausting system resources and leading to an out‑of‑memory condition. The weakness is a classic example of Allocation of Resources Without Limits or Throttling (CWE‑770).

The flaw affects OpenSSL implementations that expose the CMP functionality. No specific affected versions are listed in the CVE record, so all instances of OpenSSL that use the OSSL_CMP_CTX structure for long‑lived server processes may be impacted.

The vulnerability is exploitable from the network by any client that can send CMP messages to the server. By repeatedly sending malformed requests with large lists of extra certificates, an attacker can force the server to retain these entries indefinitely. The exploit does not require special credentials, is straightforward to launch, and can induce denial of service in a remote server process. The absence of EPSS and KEV data does not diminish the deterministic nature of the attack vector; the potential for resource exhaustion remains high for affected deployments. The CVSS score is 5.9, reflecting moderate severity.