{"id":"CVE-2026-63073","summary":"Untrusted Sender DN Used as Format String in CMP Response Validation","details":"Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary.","modified":"2026-10-28T10:55:07.432811346Z","published":"2026-08-25T12:59:43.356Z","related":["ALSA-2026:67154","ALSA-2026:67165","SUSE-SU-2026:23463-1","SUSE-SU-2026:23609-1","SUSE-SU-2026:4039-1","openSUSE-SU-2026:11623-1","openSUSE-SU-2026:21744-1"],"database_specific":{"cwe_ids":["CWE-134"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63073.json","cna_assigner":"openssl"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63073.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260825.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"98acb6b02839c609ef5b837794e08d906d965335"},{"fixed":"0c5d912057abf47505b4ad455da49fbab99b76f1"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"fixed":"f4dc4d58b48d346a8270183f89acf826d459b0ca"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"fixed":"d3c1b1169b3569ff3069e5b399f47b2b28e03d79"},{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"fixed":"f089acdf4bc7ba94a79f4bf6eb7362c3e7d14aa9"},{"fixed":"0cc20b322639919aa423e90799d9a57c3b4b76ca"},{"fixed":"6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"},{"fixed":"7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"},{"fixed":"a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"3.4.0"},{"fixed":"3.4.7"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"3.5.0"},{"fixed":"3.5.8"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","range":[{"introduced":"3.6.0"},{"fixed":"3.6.4"}]},{"range":[{"introduced":"4.0.0"},{"fixed":"4.0.2"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"},{"range":[{"fixed":"0cc20b322639919aa423e90799d9a57c3b4b76ca"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["openssl-3.4.6","openssl-3.5.7","openssl-3.6.3","openssl-4.0.1","openssl-4.0.0","openssl-3.4.5","openssl-3.5.6","openssl-3.6.2","openssl-3.4.4","openssl-3.5.5","openssl-3.6.1","3.4-POST-CLANG-FORMAT-WEBKIT","3.4-PRE-CLANG-FORMAT-WEBKIT","3.5-POST-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.4.3","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.4.2","openssl-3.5.1","openssl-3.5.0","openssl-3.4.1","openssl-3.4.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca","target":{"file":"crypto/cmp/cmp_vfy.c"},"deprecated":false,"digest":{"line_hashes":["39484352194002273856963273621476505742","264475229283889715193643162963376054363","233976805636226746805932846648301132473","33052479219208484453476762596940682932"],"threshold":0.9},"id":"CVE-2026-63073-19737d85"},{"target":{"function":"ossl_cmp_msg_check_update","file":"crypto/cmp/cmp_vfy.c"},"deprecated":false,"digest":{"function_hash":"150978737848738791715086307816514515085","length":3349},"id":"CVE-2026-63073-2bd703f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4","target":{"file":"crypto/cmp/cmp_vfy.c"},"deprecated":false,"digest":{"line_hashes":["39484352194002273856963273621476505742","264475229283889715193643162963376054363","233976805636226746805932846648301132473","33052479219208484453476762596940682932"],"threshold":0.9},"id":"CVE-2026-63073-4a8b1127","signature_type":"Line"},{"source":"https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4","target":{"file":"crypto/cmp/cmp_vfy.c","function":"ossl_cmp_msg_check_update"},"deprecated":false,"digest":{"length":3349,"function_hash":"150978737848738791715086307816514515085"},"id":"CVE-2026-63073-4dae8774","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29","target":{"function":"ossl_cmp_msg_check_update","file":"crypto/cmp/cmp_vfy.c"},"deprecated":false,"digest":{"length":3349,"function_hash":"150978737848738791715086307816514515085"},"id":"CVE-2026-63073-a47d5185","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-63073-a62d3010","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21","target":{"file":"crypto/cmp/cmp_vfy.c"},"deprecated":false,"digest":{"line_hashes":["39484352194002273856963273621476505742","264475229283889715193643162963376054363","233976805636226746805932846648301132473","33052479219208484453476762596940682932"],"threshold":0.9}},{"source":"https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21","target":{"file":"crypto/cmp/cmp_vfy.c","function":"ossl_cmp_msg_check_update"},"deprecated":false,"digest":{"function_hash":"284563502968061031432008053906106851272","length":3458},"id":"CVE-2026-63073-a7165762","signature_type":"Function","signature_version":"v1"},{"target":{"file":"crypto/cmp/cmp_vfy.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["39484352194002273856963273621476505742","264475229283889715193643162963376054363","233976805636226746805932846648301132473","33052479219208484453476762596940682932"]},"id":"CVE-2026-63073-bbbdc661","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"}],"vanir_signatures_modified":"2026-10-28T10:55:07Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63073.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}