CVE-2026-75805 in OpenSSL
Summary
by MITRE • 09/29/2026
Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response.
Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application.
CWE: CWE-476: NULL-pointer dereference
Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API.
A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash.
The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected.
FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The Common Message Protocol (CMP) serves as a critical infrastructure for certificate management within Public Key Infrastructure environments, facilitating operations such as enrollment, renewal, and revocation between clients and servers. A significant vulnerability has been identified in the CMP client implementation regarding the handling of certificate revocation requests initiated via PKCS#10 Certificate Signing Requests rather than direct certificate identifiers or issuer-serial number pairs. This flaw manifests specifically when a client utilizes the command line interface with the revoke request option combined with a CSR file, or programmatically through the OSSL_CMP_exec_RR_ses function where the certificate is supplied via OSSL_CMP_CTX_set1_p10CSR. The core technical deficiency lies in the logic that processes the server's response to such revocation requests. When a client sends a revocation request based on a CSR, it inherently lacks the issuer name and serial number associated with the target certificate because these attributes are not embedded within the PKCS#10 structure itself. Consequently, the client does transmit these specific identifiers in its initial message to the server.
Upon receiving the response from the CMP server, which may optionally include details identifying the revoked certificate for confirmation purposes, the client attempts to validate this information against what was originally submitted. Since the original request did not contain an issuer name or serial number due to the use of a CSR, internal variables intended to hold these values remain uninitialized or null. When the server returns a crafted response that includes such identification data, the client's validation logic erroneously attempts to compare this incoming data against its own empty state. This logical mismatch results in a NULL pointer dereference during the read operation required for comparison. The immediate operational impact of this flaw is severe, leading to an abnormal termination or crash of the affected CMP client application. This constitutes a Denial of Service condition where legitimate certificate management operations are interrupted and system stability is compromised due to the unexpected exception handling failure within the protocol stack.
From a threat modeling perspective, it is crucial to note that this vulnerability does not occur in isolation but requires specific conditions regarding message integrity and authentication. The revocation response undergoes validation for valid message protection before the code path containing the NULL pointer dereference is executed. This security control implies that an attacker cannot simply send arbitrary malformed packets from any source; they must possess the secret key used for CMP message protection to forge a valid, authenticated response. Therefore, exploitation of this vulnerability necessitates either access by a malicious or compromised CMP server administrator who holds these credentials, or the position of a man-in-the-middle capable of intercepting and modifying traffic while successfully spoofing the required cryptographic signatures. This significantly raises the barrier for remote unauthenticated attackers but highlights severe risks in environments where trust boundaries between clients and servers are weak or when internal network security is breached.
The classification of this vulnerability aligns with CWE-476, which defines NULL pointer dereference as a software error resulting from using an uninitialized or invalid pointer value that does not reference memory for which the program has appropriate access permissions. In the context of ATT&CK techniques, while this specific implementation flaw is primarily associated with Denial of Service rather than initial code execution, it can be leveraged within broader attack chains to disrupt availability services. Organizations relying on OpenSSL-based CMP implementations should prioritize patching their libraries to address this logic error in response processing. Mitigation strategies also include enforcing strict network segmentation and robust authentication mechanisms for all CMP communications to prevent unauthorized entities from injecting crafted responses into the protocol stream. Furthermore, clients can mitigate risk by avoiding the use of PKCS#10 CSRs for revocation requests when possible, opting instead to specify certificates directly or via issuer name and serial number pairs, thereby bypassing the code path susceptible to this NULL pointer dereference entirely.