CVE-2026-63074

*** Pendiente de traducción *** Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches<br /> additional certificates (extraCerts) sent in a CMP message, but never expunges<br /> them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX<br /> frequently, this cache of extraCerts may grow unboundedly, and a malicious<br /> client may flood a CMP server with requests driving this growth.<br /> <br /> Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX<br /> for the lifetime of a server process may observe unbounded memory growth in the<br /> event a malicious client repeatedly sends requests containing unique extra<br /> certificates, which may lead to OOM conditions.<br /> <br /> CWE: CWE-770: Allocation of Resources Without Limits or Throttling<br /> <br /> Description: If a remote user sends CMP messages to a server with a list of<br /> extraCerts and the message is rejected, the extraCerts from the message remains<br /> in the server contexts untrusted certificate stack. This exposes servers with<br /> long lived ctx objects to Denial of Service attacks in which an attacker sends<br /> messages intending to be rejected with a large list of additional certificates<br /> repeatedly, forcing the server to store them indefinitely.<br /> <br /> The issue was fixed by removing the added extra certs if the message is<br /> rejected, using the same method as when the context is configured to not do<br /> caching at all.<br /> <br /> FIPS impact: no<br /> As the CMP code lives outside the FIPS module boundary, no FIPS<br /> modules are affected by this CVE.