CVE-2026-42767: OpenSSL CMP NULL Pointer Dereference Denial of Service

Technical summary

CVE-2026-42767 is a NULL pointer dereference in OpenSSL's CMP client implementation. The vulnerability occurs when processing a CMP response containing a CRMF CertRepMessage with an EncryptedValue structure where the symmAlg (symmetric algorithm) field contains an OID reference but lacks the required parameters. This missing validation allows the pointer dereference to occur, crashing the process. The flaw is classified as CWE-476 (NULL Pointer Dereference). OpenSSL's FIPS modules (versions 4.0, 3.6, 3.5, 3.4, and 3.0) are unaffected because the vulnerable code lies outside the FIPS module boundary.

Business impact

Organizations running OpenSSL-based CMP clients face availability risk. An attacker with network access to CMP traffic—or controlling a CMP server endpoint—can trigger repeated denial-of-service conditions, disrupting certificate enrollment, renewal, or management workflows. The impact is limited to availability; confidentiality and integrity are not compromised. Affected applications will require restart to recover, potentially disrupting PKI infrastructure operations and delaying certificate lifecycle management.

Affected systems

OpenSSL CMP client implementations are vulnerable. The specific versions affected require confirmation against the OpenSSL security advisory. Applications and services that consume untrusted or internet-facing CMP/CRMF messages are at risk. This includes certificate management tools, PKI orchestration platforms, and any service leveraging OpenSSL's CMP client libraries. Verify your OpenSSL version and whether CMP client functionality is enabled or in use.

Exploitability

Exploitation requires network access to CMP traffic or the ability to act as a man-in-the-middle between client and server, or control of the CMP server itself. The CVSS score of 5.9 (Medium) reflects the network attack vector, high complexity (need for specific message crafting), and no privilege or user interaction requirements. Practical exploitation is limited to environments where an attacker can influence CMP protocol exchanges—a relatively constrained threat model compared to externally facing services.

Remediation

Apply OpenSSL security patches as released by the OpenSSL project. Verify patch availability for your specific OpenSSL version and deployment. In the interim, restrict network access to CMP servers and endpoints, enforce mutual TLS authentication, and monitor CMP client applications for unexpected crashes or restarts. Consider network segmentation to limit exposure of CMP traffic to trusted infrastructure only.

Patch guidance

Consult the OpenSSL security advisory corresponding to CVE-2026-42767 for patch version numbers and availability timelines. Patches should be tested in a non-production environment before deployment. If you manage OpenSSL libraries centrally (e.g., via package managers or vendor distributions), check those channels for patched versions. For embedded or compiled deployments, recompilation from patched source may be required.

Detection guidance

Monitor OpenSSL CMP client processes for abnormal termination or crash patterns, particularly if accompanied by CMP protocol activity logs. Implement alerting on NULL pointer dereference errors in application logs or core dumps. Network-based detection is difficult without deep packet inspection of CMP/CRMF messages; however, detecting unexpected client restarts during CMP operations may signal exploitation attempts. Correlate CMP server logs with client crash events to identify potential attacks.

Why prioritize this

Although rated Medium severity, this vulnerability should be addressed promptly if you operate CMP infrastructure or clients. The attack surface is narrow—limited to CMP implementations—but the impact is reliable and denial-of-service is operationally disruptive to PKI workflows. Organizations with limited CMP dependencies can deprioritize slightly; those relying on OpenSSL-based certificate management should treat this as higher priority within their patching cycle.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects a network-reachable vulnerability (AV:N) with high attack complexity (AC:H) due to the need for precise message crafting, no privilege or user interaction required, and high impact to availability (A:H). The score does not account for real-world attack likelihood—which is constrained by the requirement for network access to CMP traffic or CMP server compromise—but appropriately weights the reliable denial-of-service impact if preconditions are met.

Frequently asked questions