AIKIDO-2026-590576
openssl is vulnerable to Denial of Service (DoS)
37
Low Risk
This Affects:
opensslTL;DR
A CMP server that reuses one OSSL_CMP_CTX keeps extra certificates from incoming messages in that context after the message is rejected. A client can repeat rejected messages that each carry a new set of extra certificates, and the cache grows without a limit until the process runs out of memory. The fix drops those extra certificates when the message is rejected.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your CMP server reuses one OSSL_CMP_CTX across requests.
Background info
openssl is vulnerable to Denial of Service (DoS) in versions 3.0.0 - 3.0.21, 3.4.0 - 3.4.6, 3.5.0 - 3.5.7, 3.6.0 - 3.6.3 and 4.0.0 - 4.0.1.
How to fix this
Upgrade the openssl library to the patch version.
Links
GitHub Release
Fix Commits
github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9fgithub.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54afgithub.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.