UpHeron
All vulnerabilities

Servers and applications

CVE-2026-63074

Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing…

Severity
Medium 5.9
Published
25 Aug 2026
Last changed
11 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.0.22, 3.4.7, 3.5.8, 3.6.4, 4.0.2
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • From 3.0.0 before 3.0.22
  • From 3.4.0 before 3.4.7
  • From 3.5.0 before 3.5.8
  • From 3.6.0 before 3.6.4
  • From 4.0.0 before 4.0.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-63074
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-63074