CVE-2026-75805

Issue summary: A CMP client that requests certificate revocation on the basis

of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when

processing a crafted revocation response.

Impact summary: The NULL pointer dereference happens on a read which

leads to a crash and a Denial of Service for the affected client application.

CWE: CWE-476: NULL-pointer dereference

Description: A CMP client revoking a certificate has to tell the server which

certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the

certificate itself or its issuer name and serial number. This is

'openssl cmp -cmd rr -csr <file>' on the command line, or

OSSL_CMP_exec_RR_ses() with the certificate supplied via

OSSL_CMP_CTX_set1_p10CSR() through the API.

A CSR does not contain the issuer name and serial number of the certificate,

so the client does not send them. A server may optionally name the

certificate it revoked in its response, and the client then compares that

name against what it sent. Having sent neither an issuer name nor a serial

number, it has nothing to compare against, and a server returning a specially

crafted name causes the client to read from a NULL pointer and crash.

The revocation response is checked for valid message protection before

the affected code is reached, so an attacker must be a malicious or

compromised CMP server, or a man-in-the-middle in possession of the

secret used for message protection. Clients that identify the certificate

to be revoked by a certificate or by issuer and serial number rather

than by a PKCS#10 CSR are not affected.

FIPS impact: no

No FIPS modules are affected by this issue, as the CMP protocol

implementation is outside the OpenSSL FIPS module boundary.