CVE-2026-75805 - Vulnerability Details

- NULL Pointer Dereference in CMP Client Revocation Response Handling

Description

Issue summary: A CMP client that requests certificate revocation on the basis
of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when
processing a crafted revocation response.

Impact summary: The NULL pointer dereference happens on a read which
leads to a crash and a Denial of Service for the affected client application.

CWE: CWE-476: NULL-pointer dereference

Description: A CMP client revoking a certificate has to tell the server which
certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the
certificate itself or its issuer name and serial number. This is
'openssl cmp -cmd rr -csr <file>' on the command line, or
OSSL_CMP_exec_RR_ses() with the certificate supplied via
OSSL_CMP_CTX_set1_p10CSR() through the API.

A CSR does not contain the issuer name and serial number of the certificate,
so the client does not send them. A server may optionally name the
certificate it revoked in its response, and the client then compares that
name against what it sent. Having sent neither an issuer name nor a serial
number, it has nothing to compare against, and a server returning a specially
crafted name causes the client to read from a NULL pointer and crash.

The revocation response is checked for valid message protection before
the affected code is reached, so an attacker must be a malicious or
compromised CMP server, or a man-in-the-middle in possession of the
secret used for message protection. Clients that identify the certificate
to be revoked by a certificate or by issuer and serial number rather
than by a PKCS#10 CSR are not affected.

FIPS impact: no
No FIPS modules are affected by this issue, as the CMP protocol
implementation is outside the OpenSSL FIPS module boundary.

Published: 2026-09-29

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a null pointer dereference that occurs in the CMP client when it processes a revocation response received after a PKCS#10 CSR request. If the server returns a specially crafted revocation name that the client did not send, the client dereferences a NULL pointer while verifying the response, causing the application to crash. The crash results in a denial of service for the client application.

Affected Systems

This issue affects the OpenSSL library’s CMP client component. The product name is simply OpenSSL, and the documentation does not list specific affected versions; users should review the OpenSSL changelog and apply any patch that contains the referenced commits.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires a malicious or compromised CMP server, or a man‑in‑the‑middle that has possession of the message protection key, because the server’s response is first verified before the vulnerable code runs. Without such control, the risk is limited, but once an attacker can supply a crafted revocation response, the client will terminate, resulting in service disruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenSSL

unaffected

Version	Status	Constraints
`4.0.0`	affected	< 4.0.3
`3.6.0`	affected	< 3.6.5
`3.5.0`	affected	< 3.5.9
`3.4.0`	affected	< 3.4.8
`3.0.0`	affected	< 3.0.23

Configuration 1 [-]

OR	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::

No data.

Vendor Product Confidence Versions

Openssl

100%

Version	Status	Scheme	Platform
`[4.0.0,4.0.3)`	affected	semver	—
`[3.6.0,3.6.5)`	affected	semver	—
`[3.5.0,3.5.9)`	affected	semver	—
`[3.4.0,3.4.8)`	affected	semver	—
`[3.0.0,3.0.23)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update OpenSSL to a version that includes the fix referenced by commits 7588db7fef14209c3caa3a101d11a02006b19166, 7ca0ccb5172a577e9b87267d77bfe21e5481a5e7, 9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3, and abf02872a4b71767ecc72293424420f5b009190f.
Reconfigure the CMP client to identify the certificate to revoke by certificate or issuer/serial number instead of using a PKCS#10 CSR, thereby eliminating the vulnerable code path.
Ensure that the CMP client communicates only with trusted CMP servers and consider network segmentation or mutual‑auth TLS so that no attacker can supply a crafted revocation response or gain access to the message protection key.

Generated by OpenCVE AI on September 30, 2026 at 01:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4859-1	openssl security update
Debian DSA	DSA-6531-1	openssl security update
Ubuntu USN	USN-8847-1	OpenSSL vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00324.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166
https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7
https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3
https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f
https://nvd.nist.gov/vuln/detail/CVE-2026-75805
https://openssl-library.org/news/secadv/20260929.txt
https://www.cve.org/CVERecord?id=CVE-2026-75805

History

Thu, 08 Oct 2026 01:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:openssl:openssl::::::::

Wed, 30 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-75805 https://www.cve.org/CVERecord?id=CVE-2026-75805
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 29 Sep 2026 17:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Openssl Openssl openssl
Vendors & Products		Openssl Openssl openssl

Tue, 29 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 29 Sep 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.
Title		NULL Pointer Dereference in CMP Client Revocation Response Handling
Weaknesses		CWE-476
References		https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166 https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7 https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3 https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f https://openssl-library.org/news/secadv/20260929.txt

Subscriptions

Openssl Openssl

MITRE

Status: PUBLISHED

Assigner: openssl

Published: 2026-09-29T15:32:20.408Z

Updated: 2026-09-29T16:54:39.263Z

Reserved: 2026-08-18T09:34:32.659Z

Link: CVE-2026-75805

Vulnrichment

Updated: 2026-09-29T16:54:26.744Z

NVD

Status : Analyzed

Published: 2026-09-29T16:17:11.063

Modified: 2026-10-08T01:20:24.147

Link: CVE-2026-75805

Redhat

Severity : Moderate

Publid Date: 2026-09-29T15:32:20Z

Links: CVE-2026-75805 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-30T01:15:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object