CVE-2026-75805

Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr <file>' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.

• CWE-476

• https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166Patch
• https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7Patch
• https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3Patch
• https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190fPatch
• https://openssl-library.org/news/secadv/20260929.txtVendor Advisory

Published

Sep 29, 2026

Last Modified

Oct 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75799The YAHMAN Add-ons WordPress plugin before 0.9.31 does not v…9
• CVE-2026-7580A vulnerability was detected in Exiftool up to 13.53. Impact…5.3
• CVE-2026-75800The Frontegg SAML SSO WordPress plugin through 1.0.1 does no…9.8
• CVE-2026-75802AjaxEditableChoiceLabel in wicket-extensions, when construct…5.4
• CVE-2026-75803Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with…9.1
• CVE-2026-75804Issue summary: OpenSSL QUIC stack does not enforce connectio…5.3
• CVE-2026-75806Issue summary: An established DTLS 1.2 association using an …5.3
• CVE-2026-75807The SAML Single Sign On – SSO Login plugin for WordPress is …7.5
• CVE-2026-75808Allocation of Resources Without Limits or Throttling in ASUS…5.7
• CVE-2026-75809Exposed IOCTL with insufficient access control in ASUS Armou…5.9
• CVE-2026-7581A security vulnerability has been detected in alexta69 MeTub…4.3
• CVE-2026-75810Exposed Dangerous Method or Function in ASUS Armoury Crate a…5.7