CVE-2026-63073 in OpenSSL 3.6.2

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() con

Severity

Critical 9.8

Exploitation

1% chance of exploit
in the next 30 days

Fix

Update to 3.6.4, 4.0.2

Where

Workstation tool

How it matched

Exact version match

First seen

2026-11-05 01:13:58 UTC

Source

https://nvd.nist.gov/vuln/detail/CVE-2026-63073