{"id":"CVE-2026-107496","summary":"Infinite Loop in CMS_encrypt() With an EC Group Order of 1","details":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached.","modified":"2026-11-12T07:04:11.533613009Z","published":"2026-11-10T18:14:18.207Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"4.1.0"},{"fixed":"4.1.1"},{"introduced":"4.0.0"},{"fixed":"4.0.4"},{"introduced":"3.5.0"},{"fixed":"3.5.10"},{"introduced":"3.0.0"},{"fixed":"3.0.24"}]}]}],"cna_assigner":"openssl","cwe_ids":["CWE-835"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107496.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107496.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20261110.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"e04bd3433fd84e1861bf258ea37928d9845e6a86"},{"fixed":"e04bd3433fd84e1861bf258ea37928d9845e6a86"},{"introduced":"e818b74be2170fbe957a07b0da4401c2b694b3b8"},{"fixed":"e818b74be2170fbe957a07b0da4401c2b694b3b8"},{"fixed":"36e15b618decdff1b116eead6747718e6e729ad2"},{"fixed":"a8531368ddb1f86d2a2782a8b693926bb67b59e7"},{"fixed":"a0051cfe699bf5a047bc1c4faef65f80f7987366"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.1.1"},{"fixed":"1.1.1zk"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"1.0.2"},{"fixed":"1.0.2zt"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"36e15b618decdff1b116eead6747718e6e729ad2"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"a8531368ddb1f86d2a2782a8b693926bb67b59e7"}]},{"range":[{"fixed":"a0051cfe699bf5a047bc1c4faef65f80f7987366"}],"source":"REFERENCES_COMMIT"}]}}],"database_specific":{"vanir_signatures":[{"source":"https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","target":{"file":"test/ectest.c","function":"setup_tests"},"deprecated":false,"digest":{"function_hash":"20508315793794294729839070994575009660","length":1352},"id":"CVE-2026-107496-37536931","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","target":{"file":"crypto/ec/ec_key.c"},"deprecated":false,"digest":{"line_hashes":["71968775173552515909821402673074034732","72899942096322531575123448137841047856","181237454174033885126797327173246798873"],"threshold":0.9},"id":"CVE-2026-107496-451afcb8","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","target":{"file":"crypto/ec/ec_key.c","function":"ec_generate_key"},"deprecated":false,"digest":{"function_hash":"137578413424778506196389481875530599875","length":1445},"id":"CVE-2026-107496-55343caf"},{"id":"CVE-2026-107496-59f04b42","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","target":{"file":"test/ectest.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["296631169459348463309115022522608803996","21388637862587347048868320319213009372","306169889715184006361632318712836280383","153506591606091516883447830083605014496","44086482807433122161083493345694766774","144970243125112866033861743731888960307","19239497503160954926348356787493384605"]}},{"digest":{"threshold":0.9,"line_hashes":["296631169459348463309115022522608803996","21388637862587347048868320319213009372","306169889715184006361632318712836280383","283804400354139973747699878434807234537","131559021383933378870921930186772022396","17553004712277709585335430313287905590","7735920285634231066203346685806677515"]},"id":"CVE-2026-107496-70b7556f","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","target":{"file":"test/ectest.c"},"deprecated":false},{"id":"CVE-2026-107496-a2d1f881","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","target":{"file":"crypto/ec/ec_key.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["71968775173552515909821402673074034732","72899942096322531575123448137841047856","181237454174033885126797327173246798873"]}},{"source":"https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","target":{"file":"test/ectest.c","function":"setup_tests"},"deprecated":false,"digest":{"function_hash":"241517267931706269069643042598563002692","length":1300},"id":"CVE-2026-107496-a92b270e","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-107496-b2bb3532","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","target":{"file":"test/ectest.c","function":"setup_tests"},"deprecated":false,"digest":{"length":1153,"function_hash":"229191219400344287938008763465005630426"}},{"id":"CVE-2026-107496-b508aeb9","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","target":{"file":"crypto/ec/ec_key.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["71968775173552515909821402673074034732","72899942096322531575123448137841047856","181237454174033885126797327173246798873"]}},{"target":{"file":"include/openssl/opensslv.h"},"deprecated":false,"digest":{"line_hashes":["28170854778703993674264004058177114599","73132526844288570625317440636111911761","177405411499435185068645597737938634778","224809958623850711330610094965797758930","295554444428855106393106961197201359586"],"threshold":0.9},"id":"CVE-2026-107496-c377fa22","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86"},{"digest":{"line_hashes":["251633914150035957322733061977107206211","338514574181828579838011565939158652696","76638288692106140328510055542557597351","142922657400765574308962710386922248045","71649992455794854055653842592139575350","65527166711110472566013424527579064967","253196866009476977787139000804413898733","172177136897997206866313011107384691461"],"threshold":0.9},"id":"CVE-2026-107496-e051451f","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/e818b74be2170fbe957a07b0da4401c2b694b3b8","target":{"file":"crypto/opensslv.h"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","target":{"file":"crypto/ec/ec_key.c","function":"ec_generate_key"},"deprecated":false,"digest":{"length":1445,"function_hash":"137578413424778506196389481875530599875"},"id":"CVE-2026-107496-f6dc091f"},{"id":"CVE-2026-107496-f7550a13","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","target":{"function":"ec_generate_key","file":"crypto/ec/ec_key.c"},"deprecated":false,"digest":{"length":1445,"function_hash":"137578413424778506196389481875530599875"}},{"id":"CVE-2026-107496-f98440ff","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","target":{"file":"test/ectest.c"},"deprecated":false,"digest":{"line_hashes":["296631169459348463309115022522608803996","21388637862587347048868320319213009372","306169889715184006361632318712836280383","283804400354139973747699878434807234537","131559021383933378870921930186772022396","17553004712277709585335430313287905590","7735920285634231066203346685806677515"],"threshold":0.9}}],"vanir_signatures_modified":"2026-11-12T07:04:11Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107496.json"}}],"schema_version":"1.9.2"}