{"id":"UBUNTU-CVE-2026-63076","details":"Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.","modified":"2026-09-15T08:31:34.589458422Z","published":"2026-08-25T00:00:00Z","related":["USN-8678-1","USN-8678-2"],"upstream":["CVE-2026-63076"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-63076"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-63076"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8678-1"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8678-2"}],"affected":[{"package":{"name":"nodejs","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"],"ecosystem_specific":{"binaries":[{"binary_version":"4.2.6~dfsg-1ubuntu4.2+esm3","binary_name":"nodejs"},{"binary_version":"4.2.6~dfsg-1ubuntu4.2+esm3","binary_name":"nodejs-legacy"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"nodejs","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/nodejs?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"],"ecosystem_specific":{"binaries":[{"binary_name":"nodejs","binary_version":"8.10.0~dfsg-2ubuntu0.4+esm6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.29"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20","3.0.2-0ubuntu1.21","3.0.2-0ubuntu1.23","3.0.2-0ubuntu1.25","3.0.2-0ubuntu1.26"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0.2-0ubuntu1.29","binary_name":"libssl3"},{"binary_version":"3.0.2-0ubuntu1.29","binary_name":"openssl"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=fips-preview%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0.2-0ubuntu1.12+Fips1","binary_name":"libssl3"},{"binary_name":"openssl","binary_version":"3.0.2-0ubuntu1.12+Fips1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"openssl-fips","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","purl":"pkg:deb/ubuntu/openssl-fips?arch=source&distro=fips-preview%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0.5-0ubuntu0.1+Fips2.1","binary_name":"openssl-fips-module-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=fips-updates%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.29+Fips1"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1","3.0.2-0ubuntu1.14+Fips1","3.0.2-0ubuntu1.15+Fips1","3.0.2-0ubuntu1.16+Fips1","3.0.2-0ubuntu1.17+Fips1","3.0.2-0ubuntu1.18+Fips1","3.0.2-0ubuntu1.19+Fips1","3.0.2-0ubuntu1.20+Fips1","3.0.2-0ubuntu1.21+Fips1","3.0.2-0ubuntu1.23+Fips1","3.0.2-0ubuntu1.25+Fips1","3.0.2-0ubuntu1.26+Fips1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"libssl3","binary_version":"3.0.2-0ubuntu1.29+Fips1"},{"binary_name":"openssl","binary_version":"3.0.2-0ubuntu1.29+Fips1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"openssl-fips","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","purl":"pkg:deb/ubuntu/openssl-fips?arch=source&distro=fips-updates%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1","3.0.5-0ubuntu0.2+Fips1"],"ecosystem_specific":{"binaries":[{"binary_name":"openssl-fips-module-3","binary_version":"3.0.5-0ubuntu0.2+Fips1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"edk2","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/edk2?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5","2024.02-2ubuntu0.6","2024.02-2ubuntu0.7","2024.02-2ubuntu0.8","2024.02-2ubuntu0.9"],"ecosystem_specific":{"binaries":[{"binary_name":"efi-shell-aa64","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"efi-shell-arm","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"efi-shell-ia32","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"efi-shell-riscv64","binary_version":"2024.02-2ubuntu0.9"},{"binary_version":"2024.02-2ubuntu0.9","binary_name":"efi-shell-x64"},{"binary_name":"ovmf","binary_version":"2024.02-2ubuntu0.9"},{"binary_version":"2024.02-2ubuntu0.9","binary_name":"ovmf-ia32"},{"binary_name":"ovmf-legacy","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"qemu-efi-aarch64","binary_version":"2024.02-2ubuntu0.9"},{"binary_name":"qemu-efi-arm","binary_version":"2024.02-2ubuntu0.9"},{"binary_version":"2024.02-2ubuntu0.9","binary_name":"qemu-efi-riscv64"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.15"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6","3.0.13-0ubuntu3.7","3.0.13-0ubuntu3.9","3.0.13-0ubuntu3.11","3.0.13-0ubuntu3.12"],"ecosystem_specific":{"binaries":[{"binary_name":"libssl3t64","binary_version":"3.0.13-0ubuntu3.15"},{"binary_version":"3.0.13-0ubuntu3.15","binary_name":"openssl"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"openssl-fips","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","purl":"pkg:deb/ubuntu/openssl-fips?arch=source&distro=fips-updates%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.15+Fips1"}]}],"versions":["3.0.13-0ubuntu3+Fips1","3.0.13-0ubuntu3.6+Fips1","3.0.13-0ubuntu3.12+Fips1"],"ecosystem_specific":{"binaries":[{"binary_name":"openssl-fips-module-3","binary_version":"3.0.13-0ubuntu3.15+Fips1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"edk2","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/edk2?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-8ubuntu3","2025.11-3ubuntu6","2025.11-3ubuntu7","2025.11-3ubuntu7.2"],"ecosystem_specific":{"binaries":[{"binary_version":"2025.11-3ubuntu7.2","binary_name":"efi-shell-aa64"},{"binary_version":"2025.11-3ubuntu7.2","binary_name":"efi-shell-loongarch64"},{"binary_version":"2025.11-3ubuntu7.2","binary_name":"efi-shell-riscv64"},{"binary_name":"efi-shell-x64","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"ovmf","binary_version":"2025.11-3ubuntu7.2"},{"binary_name":"ovmf-amdsev","binary_version":"2025.11-3ubuntu7.2"},{"binary_version":"2025.11-3ubuntu7.2","binary_name":"ovmf-generic"},{"binary_name":"ovmf-inteltdx","binary_version":"2025.11-3ubuntu7.2"},{"binary_version":"2025.11-3ubuntu7.2","binary_name":"ovmf-legacy"},{"binary_name":"qemu-efi-aarch64","binary_version":"2025.11-3ubuntu7.2"},{"binary_version":"2025.11-3ubuntu7.2","binary_name":"qemu-efi-loongarch64"},{"binary_name":"qemu-efi-riscv64","binary_version":"2025.11-3ubuntu7.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"edk2-hwe","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/edk2-hwe?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu6","2025.11-3ubuntu8","2025.11-3ubuntu8.2"],"ecosystem_specific":{"binaries":[{"binary_name":"efi-shell-aa64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"efi-shell-loongarch64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"efi-shell-riscv64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"efi-shell-x64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_version":"2025.11-3ubuntu8.2","binary_name":"ovmf-amdsev-hwe"},{"binary_version":"2025.11-3ubuntu8.2","binary_name":"ovmf-generic-hwe"},{"binary_name":"ovmf-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"ovmf-inteltdx-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"ovmf-legacy-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"qemu-efi-aarch64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"qemu-efi-loongarch64-hwe","binary_version":"2025.11-3ubuntu8.2"},{"binary_name":"qemu-efi-riscv64-hwe","binary_version":"2025.11-3ubuntu8.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}},{"package":{"name":"openssl","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/openssl?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3.4"}]}],"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1","3.5.5-1ubuntu3","3.5.5-1ubuntu3.2","3.5.5-1ubuntu3.3"],"ecosystem_specific":{"binaries":[{"binary_name":"libssl3t64","binary_version":"3.5.5-1ubuntu3.4"},{"binary_version":"3.5.5-1ubuntu3.4","binary_name":"openssl"},{"binary_name":"openssl-provider-legacy","binary_version":"3.5.5-1ubuntu3.4"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-63076.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}