Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response

Overview

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response.

Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application.

CWE: CWE-476: NULL-pointer dereference

Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API.

A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash.

The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected.

FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.

Affected

• openssl >= 3.0.0, < 3.0.23
• openssl >= 3.4.0, < 3.4.8
• openssl >= 3.5.0, < 3.5.9
• openssl >= 3.6.0, < 3.6.5
• openssl >= 4.0.0, < 4.0.3

Remediation

Upgrade past the affected range:

• openssl 4.0.3

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Self-service automation portal 2 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Self-service automation portal 2 · updated 2026-10-21 · vex
• RHSA-2026:74162 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · advisory
• RHSA-2026:74166 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · advisory