OpenSSL CMP format string bug CVE-2026-63073 lets unauthenticated remote attackers crash PKI clients with sender or pinned cert validation. Disclosed after six months of https://deafnews.it/en/article/openssl-cmp-format-string-bug-cve-2026-63073-exposes-pki-clients-to-crash
DeafNewsOpenSSL CMP Format String Bug CVE-2026-63073 Exposes PKI Clients to Crash | DeafNewsA format string vulnerability in OpenSSL's CMP module allows unauthenticated remote attackers to crash PKI clients configured with expected sender or pinned certificate validation. The flaw was publicly disclosed on October 22, 2026, after six months of coordinated vendor engagement.