{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "4.0.0"
              },
              {
                "fixed": "4.0.2"
              },
              {
                "introduced": "3.6.0"
              },
              {
                "fixed": "3.6.4"
              },
              {
                "introduced": "3.5.0"
              },
              {
                "fixed": "3.5.8"
              },
              {
                "introduced": "3.4.0"
              },
              {
                "fixed": "3.4.7"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "11b7b6ea3b65a584e1d31408ed1bdb139465cffd"
            },
            {
              "introduced": "7b371d80d959ec9ab4139d09d78e83c090de9779"
            },
            {
              "introduced": "636dfadc70ce26f2473870570bfd9ec352806b1d"
            },
            {
              "introduced": "98acb6b02839c609ef5b837794e08d906d965335"
            },
            {
              "fixed": "f089acdf4bc7ba94a79f4bf6eb7362c3e7d14aa9"
            },
            {
              "fixed": "d3c1b1169b3569ff3069e5b399f47b2b28e03d79"
            },
            {
              "fixed": "f4dc4d58b48d346a8270183f89acf826d459b0ca"
            },
            {
              "fixed": "0c5d912057abf47505b4ad455da49fbab99b76f1"
            },
            {
              "fixed": "0cc20b322639919aa423e90799d9a57c3b4b76ca"
            },
            {
              "fixed": "6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"
            },
            {
              "fixed": "7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"
            },
            {
              "fixed": "a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"
            }
          ],
          "repo": "https://github.com/openssl/openssl",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "openssl",
    "cwe_ids": [
      "CWE-134"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63073.json"
  },
  "details": "Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary.",
  "id": "CVE-2026-63073",
  "modified": "2026-08-30T03:30:16.992869469Z",
  "published": "2026-08-25T12:59:43.356Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63073.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63073"
    },
    {
      "type": "ADVISORY",
      "url": "https://openssl-library.org/news/secadv/20260825.txt"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21"
    },
    {
      "type": "FIX",
      "url": "https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "Untrusted Sender DN Used as Format String in CMP Response Validation"
}