Skip to content
Fencer Vulns
medium 5.3

CVE-2026-75805 json

NULL Pointer Dereference in CMP Client Revocation Response Handling

published 2026-09-29 40 d ago modified 2026-10-08 32 d ago also EUVD-2026-89010

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response.

Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application.

CWE: CWE-476: NULL-pointer dereference

Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API.

A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash.

The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected.

FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.

Patch / fix

  • OpenSSL OpenSSL 3.0.23, 3.4.8, 3.5.9, 3.6.5, 4.0.3
  • openssl Debian 12 3.0.22-1~deb12u2
  • openssl Debian 13 3.5.7-1~deb13u3
  • openssl Debian 14 3.6.5-1

debian advisories DEBIAN-CVE-2026-75805

  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.30
  • openssl Ubuntu 24.04 LTS 3.0.13-0ubuntu3.16
  • openssl Ubuntu 26.04 LTS 3.5.5-1ubuntu3.6

ubuntu advisories UBUNTU-CVE-2026-75805

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl3 hummingbird 1 3.5.9-0.1.hum1
  • openssl3-libs hummingbird 1 3.5.9-0.1.hum1
  • openssl3-devel-engine hummingbird 1 3.5.9-0.1.hum1
  • openssl hummingbird 1 3.5.9-0.1.hum1
  • openssl-libs hummingbird 1 3.5.9-0.1.hum1
  • openssl-perl hummingbird 1 3.5.9-0.1.hum1
  • openssl-config-fips hummingbird 1 3.5.9-0.1.hum1
  • openssl-devel-engine hummingbird 1 3.5.9-0.1.hum1

red hat advisories RHSA-2026:74166RHSA-2026:74162

  • openssl-3 Linux Micro 6.1 3.1.4-slfo.1.1_14.1
  • openssl-3 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.5.0-160000.11.1
  • openssl-3 Linux Micro 6.0 3.1.4-159998.1.1
  • openssl-3 SLE Module for Basesystem 15 SP7 3.5.0-150700.5.53.2
  • openssl-3 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 3.0.8-150400.4.101.1
  • openssl-3 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 3.0.8-150500.5.80.1
  • openssl-3 SLES for SAP 15 SP6, SLES 15 SP6-LTSS 3.1.4-150600.5.67.1

suse advisories SUSE-SU-2026:24273-1SUSE-SU-2026:24188-1SUSE-SU-2026:24245-1SUSE-SU-2026:24133-1SUSE-SU-2026:4419-1SUSE-SU-2026:4414-1

  • openssl-3 openSUSE Leap 16.0 3.5.0-160000.11.1

opensuse advisories openSUSE-SU-2026:22102-1

  • openssl Alpine 3.21 3.3.7-r2

alpine advisories ALPINE-CVE-2026-75805

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • edk2 Azure Linux 3.0 20240524git3e722403cd16-21
  • openssl Azure Linux 3.0 3.3.7-7

azure linux advisories AZL-105477AZL-105591

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-75805 updated cvss 5.9

openssl: openssl: Denial of Service via crafted CMP certificate revocation response

  • Red Hat Enterprise Linux 9 openssl, shim-x64, shim-aa64, openssl-libs, openssl-perl, compat-openssl11, +5 more Red Hat Enterprise Linux 10 shim 16.1-4.el10, openssl 3.5.8-1.el10_2, edk2 20260221-7.el10_3.1, shim-unsigned-x64 16.1-1.el10, shim-unsigned-aarch64 16.1-2.el10 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9 Red Hat Self-service automation portal 2 ansible-automation-platform/bootc-automation-portal-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 9 edk2-ovmf, edk2-tools, edk2-aarch64, edk2 20260221-7.el10_3.1 Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
    under investigation
  • Red Hat Hardened Images openssl 3.5.9-0.1.hum1, openssl3 3.5.9-0.1.hum1, openssl-libs 3.5.9-0.1.hum1, openssl-perl 3.5.9-0.1.hum1, openssl3-libs 3.5.9-0.1.hum1, openssl-config-fips 3.5.9-0.1.hum1, +3 more
    fixed: vendor fix RHSA-2026:74162
  • Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 6 openssl, openssl-perl, openssl 3.5.8-1.el10_2 Red Hat Enterprise Linux 7 ovmf, OVMF, shim, AAVMF, mokutil, openssl, +6 more Red Hat Enterprise Linux 8 openssl, shim-x64, edk2-ovmf, shim-aa64, shim-ia32, edk2-aarch64, +13 more Red Hat Hardened Images unbound 1.26.1-1.hum1 Red Hat JBoss Core Services jbcs-httpd24-openssl, jbcs-httpd24-openssl-libs, jbcs-httpd24-openssl-perl
    +3 more products
    Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8 Red Hat Satellite 6 puppet-agent, openvox-agent 8.28.1-1.el9sat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
40 d ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • OpenSSL OpenSSL

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.