{"id":"CVE-2026-63073","summary":"Untrusted Sender DN Used as Format String in CMP Response Validation","details":"Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary.","modified":"2026-08-30T08:13:42.783441Z","published":"2026-08-25T12:59:43.356Z","related":["openSUSE-SU-2026:11623-1"],"database_specific":{"cna_assigner":"openssl","cwe_ids":["CWE-134"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63073.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63073.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073"},{"type":"ADVISORY","url":"https://openssl-library.org/news/secadv/20260825.txt"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"11b7b6ea3b65a584e1d31408ed1bdb139465cffd"},{"introduced":"7b371d80d959ec9ab4139d09d78e83c090de9779"},{"introduced":"636dfadc70ce26f2473870570bfd9ec352806b1d"},{"introduced":"98acb6b02839c609ef5b837794e08d906d965335"},{"fixed":"f089acdf4bc7ba94a79f4bf6eb7362c3e7d14aa9"},{"fixed":"d3c1b1169b3569ff3069e5b399f47b2b28e03d79"},{"fixed":"f4dc4d58b48d346a8270183f89acf826d459b0ca"},{"fixed":"0c5d912057abf47505b4ad455da49fbab99b76f1"},{"fixed":"0cc20b322639919aa423e90799d9a57c3b4b76ca"},{"fixed":"6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"},{"fixed":"7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"},{"fixed":"a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"}],"database_specific":{"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.0.2"},{"introduced":"3.6.0"},{"fixed":"3.6.4"},{"introduced":"3.5.0"},{"fixed":"3.5.8"},{"introduced":"3.4.0"},{"fixed":"3.4.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["openssl-3.4.6","openssl-3.5.7","openssl-3.6.3","openssl-4.0.1","openssl-4.0.0","openssl-3.4.5","openssl-3.5.6","openssl-3.6.2","openssl-3.4.4","openssl-3.5.5","openssl-3.6.1","3.4-POST-CLANG-FORMAT-WEBKIT","3.4-PRE-CLANG-FORMAT-WEBKIT","3.5-POST-CLANG-FORMAT-WEBKIT","3.5-PRE-CLANG-FORMAT-WEBKIT","3.6-POST-CLANG-FORMAT-WEBKIT","3.6-PRE-CLANG-FORMAT-WEBKIT","openssl-3.6.0","openssl-3.4.3","openssl-3.5.4","openssl-3.5.3","openssl-3.5.2","openssl-3.4.2","openssl-3.5.1","openssl-3.5.0","openssl-3.4.1","openssl-3.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63073.json","vanir_signatures_modified":"2026-08-30T08:13:42Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca","target":{"file":"crypto/cmp/cmp_vfy.c"},"deprecated":false,"digest":{"line_hashes":["39484352194002273856963273621476505742","264475229283889715193643162963376054363","233976805636226746805932846648301132473","33052479219208484453476762596940682932"],"threshold":0.9},"id":"CVE-2026-63073-19737d85","signature_type":"Line"},{"digest":{"function_hash":"150978737848738791715086307816514515085","length":3349},"id":"CVE-2026-63073-2bd703f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca","target":{"function":"ossl_cmp_msg_check_update","file":"crypto/cmp/cmp_vfy.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4","target":{"file":"crypto/cmp/cmp_vfy.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["39484352194002273856963273621476505742","264475229283889715193643162963376054363","233976805636226746805932846648301132473","33052479219208484453476762596940682932"]},"id":"CVE-2026-63073-4a8b1127"},{"digest":{"length":3349,"function_hash":"150978737848738791715086307816514515085"},"id":"CVE-2026-63073-4dae8774","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4","target":{"file":"crypto/cmp/cmp_vfy.c","function":"ossl_cmp_msg_check_update"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"150978737848738791715086307816514515085","length":3349},"id":"CVE-2026-63073-a47d5185","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29","target":{"file":"crypto/cmp/cmp_vfy.c","function":"ossl_cmp_msg_check_update"}},{"deprecated":false,"digest":{"line_hashes":["39484352194002273856963273621476505742","264475229283889715193643162963376054363","233976805636226746805932846648301132473","33052479219208484453476762596940682932"],"threshold":0.9},"id":"CVE-2026-63073-a62d3010","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21","target":{"file":"crypto/cmp/cmp_vfy.c"}},{"source":"https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21","target":{"file":"crypto/cmp/cmp_vfy.c","function":"ossl_cmp_msg_check_update"},"deprecated":false,"digest":{"length":3458,"function_hash":"284563502968061031432008053906106851272"},"id":"CVE-2026-63073-a7165762","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29","target":{"file":"crypto/cmp/cmp_vfy.c"},"deprecated":false,"digest":{"line_hashes":["39484352194002273856963273621476505742","264475229283889715193643162963376054363","233976805636226746805932846648301132473","33052479219208484453476762596940682932"],"threshold":0.9},"id":"CVE-2026-63073-bbbdc661"}]}}],"schema_version":"1.9.0"}