CVE-2026-42767

Issue summary: An attacker-controlled CMP (Certificate Management Protocol)<br /> server could trigger a NULL pointer dereference in a CMP client application.<br /> <br /> Impact summary: A NULL pointer dereference causes a crash of the<br /> application and a Denial of Service.<br /> <br /> An attacker controlling a CMP server (or acting as a man-in-the-middle) could<br /> craft a CMP response containing a CRMF (Certificate Request Message Format)<br /> CertRepMessage with an EncryptedValue structure where the symmAlg field<br /> has an algorithm OID but no parameters field. When the OpenSSL CMP client<br /> processes this response, the NULL dereference occurs, causing a crash of<br /> the CMP client.<br /> <br /> Applications that process untrusted CMP/CRMF messages may be affected.<br /> <br /> The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this<br /> issue, as the affected code is outside the OpenSSL FIPS module boundary.