CVE-2026-63074 (GCVE-0-2026-63074)

Vulnerability from cvelistv5 – Published: 2026-08-25 12:59 – Updated: 2026-08-25 14:36
VLAI
Title
CMP Indefinite Cache Growth of ExtraCerts
Summary
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 14:36 UTC
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version CPE status
OpenSSL OpenSSL Affected: 4.0.0 , < 4.0.2 (semver)
Affected: 3.6.0 , < 3.6.4 (semver)
Affected: 3.5.0 , < 3.5.8 (semver)
Affected: 3.4.0 , < 3.4.7 (semver)
Affected: 3.0.0 , < 3.0.22 (semver)
guessed Create a notification for this product.
Date Public
2026-08-25 11:36
Credits
Pavоl Žáčik (Red Hat) Neil Horman
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-63074",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T14:36:10.702053Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T14:36:13.170Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.2",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.4",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.8",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.7",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.22",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Pav\u043el \u017d\u00e1\u010dik (Red Hat)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Neil Horman"
        }
      ],
      "datePublic": "2026-08-25T11:36:16.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\u003cbr\u003eadditional certificates (extraCerts) sent in a CMP message, but never expunges\u003cbr\u003ethem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\u003cbr\u003efrequently, this cache of extraCerts may grow unboundedly, and a malicious\u003cbr\u003eclient may flood a CMP server with requests driving this growth.\u003cbr\u003e\u003cbr\u003eImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\u003cbr\u003efor the lifetime of a server process may observe unbounded memory growth in the\u003cbr\u003eevent a malicious client repeatedly sends requests containing unique extra\u003cbr\u003ecertificates, which may lead to OOM conditions.\u003cbr\u003e\u003cbr\u003eCWE: CWE-770: Allocation of Resources Without Limits or Throttling\u003cbr\u003e\u003cbr\u003eDescription: If a remote user sends CMP messages to a server with a list of\u003cbr\u003eextraCerts and the message is rejected, the extraCerts from the message remains\u003cbr\u003ein the server contexts untrusted certificate stack.  This exposes servers with\u003cbr\u003elong lived ctx objects to Denial of Service attacks in which an attacker sends\u003cbr\u003emessages intending to be rejected with a large list of additional certificates\u003cbr\u003erepeatedly, forcing the server to store them indefinitely.\u003cbr\u003e   \u003cbr\u003eThe issue was fixed by removing the added extra certs if the message is\u003cbr\u003erejected, using the same method as when the context is configured to not do\u003cbr\u003ecaching at all.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eAs the CMP code lives outside the FIPS module boundary, no FIPS\u003cbr\u003emodules are affected by this CVE."
            }
          ],
          "value": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack.  This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n   \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T12:59:58.278Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260825.txt"
        },
        {
          "name": "4.0.2 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46"
        },
        {
          "name": "3.6.4 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7"
        },
        {
          "name": "3.5.8 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af"
        },
        {
          "name": "3.4.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a"
        },
        {
          "name": "3.0.22 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CMP Indefinite Cache Growth of ExtraCerts",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-63074",
    "datePublished": "2026-08-25T12:59:58.278Z",
    "dateReserved": "2026-07-15T13:10:26.188Z",
    "dateUpdated": "2026-08-25T14:36:13.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63074",
      "date": "2026-08-27",
      "epss": "0.00488",
      "percentile": "0.39933"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63074\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2026-08-25T13:19:26.283\",\"lastModified\":\"2026-08-25T15:16:36.243\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\\nclient may flood a CMP server with requests driving this growth.\\n\\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\\nfor the lifetime of a server process may observe unbounded memory growth in the\\nevent a malicious client repeatedly sends requests containing unique extra\\ncertificates, which may lead to OOM conditions.\\n\\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\\n\\nDescription: If a remote user sends CMP messages to a server with a list of\\nextraCerts and the message is rejected, the extraCerts from the message remains\\nin the server contexts untrusted certificate stack.  This exposes servers with\\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\\nmessages intending to be rejected with a large list of additional certificates\\nrepeatedly, forcing the server to store them indefinitely.\\n   \\nThe issue was fixed by removing the added extra certs if the message is\\nrejected, using the same method as when the context is configured to not do\\ncaching at all.\\n\\nFIPS impact: no\\nAs the CMP code lives outside the FIPS module boundary, no FIPS\\nmodules are affected by this CVE.\"}],\"affected\":[{\"source\":\"openssl-security@openssl.org\",\"affectedData\":[{\"vendor\":\"OpenSSL\",\"product\":\"OpenSSL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.0.0\",\"lessThan\":\"4.0.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.6.0\",\"lessThan\":\"3.6.4\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"lessThan\":\"3.5.8\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.4.0\",\"lessThan\":\"3.4.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.0.0\",\"lessThan\":\"3.0.22\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-25T14:36:10.702053Z\",\"id\":\"CVE-2026-63074\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"openssl-security@openssl.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://openssl-library.org/news/secadv/20260825.txt\",\"source\":\"openssl-security@openssl.org\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-27T08:00:46+00:00",
      "cve": "CVE-2026-63074",
      "id": "CVE-2026-63074",
      "initial_release_date": "2026-08-25T00:00:00+00:00",
      "product_status:fixed": "6",
      "product_status:known_affected": "26",
      "product_status:known_not_affected": "56",
      "product_status:under_investigation": "9",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssl: CMP indefinite cache growth of ExtraCerts",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63074.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-63074\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-25T14:36:10.702053Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-25T14:36:07.661Z\"}}], \"cna\": {\"title\": \"CMP Indefinite Cache Growth of ExtraCerts\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Pav\\u043el \\u017d\\u00e1\\u010dik (Red Hat)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Neil Horman\"}], \"metrics\": [{\"other\": {\"type\": \"https://openssl-library.org/policies/general/security-policy/\", \"content\": {\"text\": \"Low\"}}, \"format\": \"other\"}], \"affected\": [{\"vendor\": \"OpenSSL\", \"product\": \"OpenSSL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.2\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.6.0\", \"lessThan\": \"3.6.4\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.5.0\", \"lessThan\": \"3.5.8\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.4.0\", \"lessThan\": \"3.4.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.0.22\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-08-25T11:36:16.000Z\", \"references\": [{\"url\": \"https://openssl-library.org/news/secadv/20260825.txt\", \"name\": \"OpenSSL Advisory\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46\", \"name\": \"4.0.2 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7\", \"name\": \"3.6.4 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af\", \"name\": \"3.5.8 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a\", \"name\": \"3.4.7 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f\", \"name\": \"3.0.22 git commit\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\\nclient may flood a CMP server with requests driving this growth.\\n\\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\\nfor the lifetime of a server process may observe unbounded memory growth in the\\nevent a malicious client repeatedly sends requests containing unique extra\\ncertificates, which may lead to OOM conditions.\\n\\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\\n\\nDescription: If a remote user sends CMP messages to a server with a list of\\nextraCerts and the message is rejected, the extraCerts from the message remains\\nin the server contexts untrusted certificate stack.  This exposes servers with\\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\\nmessages intending to be rejected with a large list of additional certificates\\nrepeatedly, forcing the server to store them indefinitely.\\n   \\nThe issue was fixed by removing the added extra certs if the message is\\nrejected, using the same method as when the context is configured to not do\\ncaching at all.\\n\\nFIPS impact: no\\nAs the CMP code lives outside the FIPS module boundary, no FIPS\\nmodules are affected by this CVE.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\u003cbr\u003eadditional certificates (extraCerts) sent in a CMP message, but never expunges\u003cbr\u003ethem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\u003cbr\u003efrequently, this cache of extraCerts may grow unboundedly, and a malicious\u003cbr\u003eclient may flood a CMP server with requests driving this growth.\u003cbr\u003e\u003cbr\u003eImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\u003cbr\u003efor the lifetime of a server process may observe unbounded memory growth in the\u003cbr\u003eevent a malicious client repeatedly sends requests containing unique extra\u003cbr\u003ecertificates, which may lead to OOM conditions.\u003cbr\u003e\u003cbr\u003eCWE: CWE-770: Allocation of Resources Without Limits or Throttling\u003cbr\u003e\u003cbr\u003eDescription: If a remote user sends CMP messages to a server with a list of\u003cbr\u003eextraCerts and the message is rejected, the extraCerts from the message remains\u003cbr\u003ein the server contexts untrusted certificate stack.  This exposes servers with\u003cbr\u003elong lived ctx objects to Denial of Service attacks in which an attacker sends\u003cbr\u003emessages intending to be rejected with a large list of additional certificates\u003cbr\u003erepeatedly, forcing the server to store them indefinitely.\u003cbr\u003e   \u003cbr\u003eThe issue was fixed by removing the added extra certs if the message is\u003cbr\u003erejected, using the same method as when the context is configured to not do\u003cbr\u003ecaching at all.\u003cbr\u003e\u003cbr\u003eFIPS impact: no\u003cbr\u003eAs the CMP code lives outside the FIPS module boundary, no FIPS\u003cbr\u003emodules are affected by this CVE.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770 Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"shortName\": \"openssl\", \"dateUpdated\": \"2026-08-25T12:59:58.278Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-63074\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T14:36:13.170Z\", \"dateReserved\": \"2026-07-15T13:10:26.188Z\", \"assignerOrgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"datePublished\": \"2026-08-25T12:59:58.278Z\", \"assignerShortName\": \"openssl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.