NULL Pointer Dereference in CMP Client Revocation Response Handling

Summary

CVE	CVE-2026-75805
State	PUBLISHED
Assigner	openssl
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-09-29 16:17:11 UTC
Updated	2026-10-08 01:20:24 UTC
Description	Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.

Risk And Classification

Primary CVSS: v3.1 5.3 MEDIUM from ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Problem Types: CWE-476 | CWE-476 CWE-476 NULL-pointer dereference

Version	Source	Type	Score	Severity	Vector
3.1	ADP	DECLARED	5.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	5.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Openssl	Openssl	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	OpenSSL	OpenSSL	affected 4.0.0 4.0.3 semver	Not specified
CNA	OpenSSL	OpenSSL	affected 3.6.0 3.6.5 semver	Not specified
CNA	OpenSSL	OpenSSL	affected 3.5.0 3.5.9 semver	Not specified
CNA	OpenSSL	OpenSSL	affected 3.4.0 3.4.8 semver	Not specified
CNA	OpenSSL	OpenSSL	affected 3.0.0 3.0.23 semver	Not specified

References

Reference	Source	Link	Tags
github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166	[email protected]	github.com	Patch
openssl-library.org/news/secadv/20260929.txt	[email protected]	openssl-library.org	Vendor Advisory
github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f	[email protected]	github.com	Patch
github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7	[email protected]	github.com	Patch
github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3	[email protected]	github.com	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Bhabani Sankar Das (en)

CNA: Norbert Pocs (en)

There are currently no legacy QID mappings associated with this CVE.