The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application.
Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service.
An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client.
Applications that process untrusted CMP/CRMF messages may be affected.
The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opensslUpgrade openssl-libsUpgrade openssl-perlUpgrade openssl-devel | Jun 16, 2026 | Jun 11, 2026 |
| Alpine Linux | — | Upgrade openssl | Jun 18, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade opensslUpgrade openssl-debuginfoUpgrade openssl-debugsourceUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-perlUpgrade openssl-libsUpgrade openssl-snapsafe-libsUpgrade openssl-libs-debuginfoUpgrade openssl-fips-provider-latest-debuginfoUpgrade openssl-develUpgrade openssl-fips-provider-latest | Jun 23, 2026 | Jun 9, 2026 |
| Debian | — | Upgrade openssl | Jul 23, 2026 | Jun 9, 2026 |
| Freebsd | — | Upgrade openssl111Upgrade openssl34Upgrade opensslUpgrade openssl35Upgrade FreeBSDUpgrade openssl36Upgrade openssl40 | Jun 15, 2026 | Jun 10, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 10, 2026 | Jun 9, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory48 | Jul 22, 2026 | Jul 21, 2026 |
| Oracle Missing Cpu Jul 2026 | — | Apply the July 2026 Critical Patch Update (CPU) for Oracle Database | Jul 22, 2026 | Jun 9, 2026 |
| Redhat_linux | — | Upgrade openssl-libs-debuginfoNo solution existsUpgrade openssl-perlUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-debugsourceUpgrade openssl-libsUpgrade openssl-devel | Jun 17, 2026 | Jun 9, 2026 |
| Rocky_linux | — | Upgrade openssl-libs-debuginfoUpgrade openssl-debugsourceUpgrade openssl-debuginfoUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-perlUpgrade openssl | Jun 17, 2026 | Jun 13, 2026 |
| Ubuntu | — | Upgrade libssl3t64Upgrade libssl3Upgrade openssl | Jun 16, 2026 | Jun 9, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 17, 2026 | Jun 9, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub