CVE-2026-75805

/// Technical description

Issue summary: A CMP client that requests certificate revocation on the basis

of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when

processing a crafted revocation response.

Impact summary: The NULL pointer dereference happens on a read which

leads to a crash and a Denial of Service for the affected client application.

CWE: CWE-476: NULL-pointer dereference

Description: A CMP client revoking a certificate has to tell the server which

certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the

certificate itself or its issuer name and serial number. This is

'openssl cmp -cmd rr -csr <file>' on the command line, or

OSSL_CMP_exec_RR_ses() with the certificate supplied via

OSSL_CMP_CTX_set1_p10CSR() through the API.

A CSR does not contain the issuer name and serial number of the certificate,

so the client does not send them. A server may optionally name the

certificate it revoked in its response, and the client then compares that

name agains

/// Remediation

Check the references section for vendor advisories and patches from openssl. Update openssl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References