Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg…

CVE-2026-63076 is an invalid pointer dereference in OpenSSL's Certificate Management Protocol (CMP) implementation. When verifying password-based MAC (PBM) protection on incoming CMP messages, OpenSSL calls X509_ALGOR_get0() to read the protectionAlg parameter but only checks whether the returned pointer is non-NULL — it never validates the ASN.1 type before casting to PBMParameter. A remote attacker can send a crafted CMP message with a mistyped protectionAlg field, causing a crash. Affected versions span OpenSSL 3.0.0–3.0.21, 3.4.0–3.4.6, 3.5.0–3.5.7, 3.6.0–3.6.3, and 4.0.0–4.0.1. Fixed in 3.0.22, 3.4.7, 3.5.8, 3.6.4, and 4.0.2.

The NVD-assigned CVSS 7.5 (HIGH) reflects the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which is technically accurate for a network-reachable unauthenticated crash. However, OpenSSL's own project rates this Moderate, and that is far closer to reality. CMP is a specialized certificate enrollment protocol that applications must *explicitly enable* — the vast majority of OpenSSL consumers (web servers, TLS clients, VPN endpoints) never touch CMP code at all. The 7.5 score dramatically overstates risk for any organization that does not operate a CMP-enabled PKI enrollment service.

Why this verdict

• Niche attack surface: CMP must be explicitly enabled by the application developer; standard TLS server/client usage of OpenSSL never invokes this code. This alone eliminates >99% of OpenSSL deployments from scope.
• DoS-only impact ceiling: The vulnerability causes a process crash via invalid pointer dereference. There is no memory disclosure, no controlled write, and no viable path to remote code execution. A process restart fully restores service.
• No exploitation leverage: No public PoC, no KEV listing, no observed campaigns. The protocol knowledge required (RFC 4210 CMP framing with ASN.1 type manipulation) is niche.
• Role multiplier: CMP servers are PKI/CA infrastructure (high-value role). If the chain succeeds, the blast radius is *availability loss of certificate enrollment* — not domain takeover, not fleet compromise, not data exfiltration. A crashed CMP endpoint auto-restarts and issues no certificates during downtime (seconds to minutes). This limits the high-value-role outcome to temporary availability disruption, which does not meet the floor criteria of 'domain takeover / fleet compromise / mass data egress / supply-chain pivot.'
• OpenSSL's own assessment agrees: The OpenSSL project rates this Moderate, not High, explicitly because of the limited attack surface.

Why not higher?

Upgrading to HIGH would require either active exploitation, a broader attack surface, or an impact beyond DoS. None of these conditions exist. CMP is not a default-enabled feature, no PoC is public, and the impact is a recoverable crash with no confidentiality or integrity consequences. Even in PKI environments, the blast radius is temporary enrollment downtime, not compromise of issued certificates or CA key material.

Why not lower?

Dropping to LOW would undercount the risk for the small number of organizations that *do* run CMP-enabled PKI enrollment services. In those environments, the vulnerability is unauthenticated and network-reachable, and a sustained attack could repeatedly crash the enrollment service. The breadth of affected OpenSSL versions (3.0 through 4.0) also means any CMP deployment is likely vulnerable.

1. Restrict network access to CMP endpoints — Place CMP enrollment services behind firewall rules or a reverse proxy that limits source IPs to authorized RAs and enrollment clients. This eliminates unauthenticated internet-sourced attacks. Deploy within the noisgate remediation SLA of 365 days for MEDIUM, or sooner if your CMP service is externally reachable.
2. Enable process watchdog/auto-restart — Ensure CMP server processes are managed by systemd, supervisord, or equivalent with automatic restart on crash. This limits DoS window to seconds per crash attempt. Most production deployments already have this.
3. Rate-limit CMP HTTP requests — Apply rate limiting at the reverse proxy or load balancer layer to throttle repeated crash attempts and make sustained DoS impractical.
4. Patch OpenSSL to fixed version — Upgrade to OpenSSL 3.0.22, 3.4.7, 3.5.8, 3.6.4, or 4.0.2 depending on your branch. This is the definitive fix. Target the noisgate remediation SLA of 365 days for MEDIUM severity.

Run this script on each host where OpenSSL is installed. It checks the installed OpenSSL version against known-vulnerable ranges. Execute as any user: bash check_cve_2026_63076.sh. No elevated privileges required.

#!/bin/bash\n# CVE-2026-63076 checker — Invalid Pointer Dereference in OpenSSL CMP\n# Run on target host. No privileges required.\n\nVERSION=$(openssl version 2>/dev/null | awk '{print $2}')\n\nif [ -z \"$VERSION\" ]; then\n  echo \"UNKNOWN — openssl binary not found in PATH\"\n  exit 2\nfi\n\necho \"Detected OpenSSL version: $VERSION\"\n\n# Parse major.minor.patch\nIFS='.' read -r MAJOR MINOR PATCH <<< \"$(echo \"$VERSION\" | sed 's/[^0-9.]//g')\"\n\nvulnerable=0\n\nif [ \"$MAJOR\" -eq 4 ] && [ \"$MINOR\" -eq 0 ]; then\n  [ \"$PATCH\" -lt 2 ] && vulnerable=1\nelif [ \"$MAJOR\" -eq 3 ] && [ \"$MINOR\" -eq 6 ]; then\n  [ \"$PATCH\" -lt 4 ] && vulnerable=1\nelif [ \"$MAJOR\" -eq 3 ] && [ \"$MINOR\" -eq 5 ]; then\n  [ \"$PATCH\" -lt 8 ] && vulnerable=1\nelif [ \"$MAJOR\" -eq 3 ] && [ \"$MINOR\" -eq 4 ]; then\n  [ \"$PATCH\" -lt 7 ] && vulnerable=1\nelif [ \"$MAJOR\" -eq 3 ] && [ \"$MINOR\" -eq 0 ]; then\n  [ \"$PATCH\" -lt 22 ] && vulnerable=1\nfi\n\nif [ \"$vulnerable\" -eq 1 ]; then\n  echo \"VULNERABLE — OpenSSL $VERSION is in the affected range for CVE-2026-63076\"\n  echo \"Note: Only exploitable if application explicitly uses CMP (Certificate Management Protocol)\"\n  exit 1\nelse\n  echo \"PATCHED — OpenSSL $VERSION is not affected or is a fixed release\"\n  exit 0\nfi

Sources

1. OpenSSL Vulnerabilities Page (3.6 series)
2. OpenSSL Vulnerabilities Index
3. OpenSSL 3.0 Series Release Notes
4. OpenSSL 3.6 Series Release Notes
5. OpenSSL GitHub Releases
6. Keyfactor CMP Operations Guide
7. EJBCA Blog — CMP with OpenSSL