Multiple OpenSSL Flaws Let Remote Attackers Crash Servers and Corrupt Heap Memory

OpenSSL has issued a fresh security advisory disclosing seven vulnerabilities across its cryptographic library, ranging from a heap-corrupting write bug to memory-exhaustion flaws in its QUIC and DTLS implementations.

The flaws affect widely deployed branches, including OpenSSL 4.0, 3.6, 3.5, 3.4, and 3.0, and, in some cases, the legacy 1.1.1 line, making patching a priority for any organization running TLS, CMS, or CMP services built on the library.

OpenSSL Patches 9 Vulnerabilities

The most severe issue, tracked as CVE-2026-63072 and rated Moderate, lives in OpenSSL’s CMS decryption code. When sizing the buffer for an unwrapped key, the library queries the expected output length, but the AES-WRAP-PAD unwrap primitive can actually write and cleanse more bytes than that query reports.

An attacker can take a legitimate encrypted message, flip a single byte in its key-wrap algorithm identifier, and force an 8-byte out-of-bounds heap write whenever the victim calls CMS_decrypt(). Because the write is fixed in size and value, exploitation is reliable and requires no special server configuration, though OpenSSL notes the realistic outcome is heap corruption and a denial of service rather than code execution.

A second Moderate-severity flaw, CVE-2026-63076, affects the Certificate Management Protocol (CMP). During password-based MAC verification, OpenSSL checks only that a protection algorithm parameter is non-null without confirming its actual type, allowing a crafted message to trigger an invalid pointer dereference.

The bug is remotely triggerable by an unauthenticated attacker against any application running a CMP server that accepts PBM-protected messages, and can equally crash a CMP client connecting to a malicious or intercepted server.

The advisory also details five Low-severity issues. CVE-2026-14457 can cause a null pointer dereference in TLS servers or clients configured with Raw Public Keys but no accompanying certificate, when a peer sends the signature_algorithms_cert extension.

CVE ID	Vulnerability	CWE	Affected Versions	Fixed Versions
CVE-2026-63072	Heap buffer overflow in CMS key unwrapping — crafted CMS message triggers an 8-byte out-of-bounds heap write via CMS_decrypt()	CWE-787: Out-of-bounds Write	4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1	4.0.2, 3.6.4, 3.5.8, 3.4.7, 3.0.22, 1.1.1zi
CVE-2026-63076	Invalid pointer dereference in CMP server via crafted protectionAlg — remote, unauthenticated crash of CMP servers or clients	CWE-476: NULL Pointer Dereference	4.0, 3.6, 3.5, 3.4, 3.0	4.0.2, 3.6.4, 3.5.8, 3.4.7, 3.0.22
CVE-2026-14457	NULL pointer dereference in Raw Public Key (RPK) configurations with key-only setup when peer sends signature_algorithms_cert extension	CWE-476: NULL Pointer Dereference	4.0, 3.6, 3.5, 3.4	4.0.2, 3.6.4, 3.5.8, 3.4.7
CVE-2026-54874	Excessive memory use buffering DTLS records for a future epoch — ~1,200x memory amplification enabling memory exhaustion	CWE-405: Asymmetric Resource Consumption	4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, 1.0.2	4.0.2, 3.6.4, 3.5.8, 3.4.7, 3.0.22, 1.1.1zi, 1.0.2zr
CVE-2026-63073	Untrusted sender DN used as format string in CMP response validation — malicious CMP endpoint can crash clients	CWE-134: Externally-Controlled Format String	4.0, 3.6, 3.5, 3.4	4.0.2, 3.6.4, 3.5.8, 3.4.7
CVE-2026-63074	Indefinite cache growth of extraCerts in CMP — malicious client floods long-lived server contexts, causing OOM conditions	CWE-770: Resource Allocation Without Limits	4.0, 3.6, 3.5, 3.4, 3.0	4.0.2, 3.6.4, 3.5.8, 3.4.7, 3.0.22
CVE-2026-63075	QUIC ACK-only packet metadata retention — peer withholding ACKs forces connection-scoped memory growth and exhaustion	CWE-770: Resource Allocation Without Limits	4.0, 3.6, 3.5, 3.4	4.0.2, 3.6.4, 3.5.8, 3.4.7
CVE-2026-75803	AEAD forgeries with empty ciphertext via EVP_Cipher() — ChaCha20-Poly1305 and AES-OCB skip tag verification, allowing forged messages	CWE-354: Improper Integrity Check Validation	4.0, 3.6, 3.5, 3.4, 3.0	4.0.2, 3.6.4, 3.5.8, 3.4.7, 3.0.22

CVE-2026-54874 lets an attacker amplify network traffic by roughly 1,200 times, tricking a DTLS endpoint into buffering large read buffers for small forged records tied to a future handshake epoch, straining memory on busy servers.

CVE-2026-63073 stems from CMP response validation passing an untrusted sender distinguished name directly into a logging function as a format string, letting a malicious CMP endpoint crash a client through classic format-string abuse.

CVE-2026-63074 allows unbounded growth of cached extra certificates on long-lived CMP server contexts when rejected messages aren’t cleaned up, risking out-of-memory conditions.

CVE-2026-63075 similarly enables memory exhaustion in OpenSSL’s QUIC stack, where a peer that withholds acknowledgments while forcing ACK-only packets can inflate per-connection memory usage.

Finally, CVE-2026-75803 affects AEAD ciphers ChaCha20-Poly1305 and AES-OCB, where calling EVP_Cipher() on empty ciphertext can report a successful decryption without actually verifying the authentication tag, opening the door to forged messages.

OpenSSL has released fixed versions for every affected branch: 4.0.2, 3.6.4, 3.5.8, 3.4.7, and 3.0.22, with premium support customers on 1.1.1 and 1.0.2 receiving separate backports. None of the flaws touch the FIPS module boundary.

Given the breadth of affected branches and the remote, unauthenticated nature of several bugs, security teams should prioritize inventorying OpenSSL usage across TLS, CMS, and CMP-enabled applications and apply the relevant patched release without delay.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC