Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

ZDI publishes two separate OpenSSL CMP and CMS advisories

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ZDI published two distinct OpenSSL advisories on October 22, naming no fixed versions and not reporting exploitation.

ZDI published two separate OpenSSL advisories on October 22, 2026. ZDI-26-789 covers CVE-2026-63073, an externally controlled format-string flaw in the CMP component rated CVSS 6.5; remote attackers can disclose information without authentication. ZDI-26-790 covers CVE-2026-34182, improper validation of the integrity check value in CMS AuthEnvelopedData handling, rated CVSS 3.1. That issue requires an attacker who can already modify those messages. Neither advisory lists affected or fixed versions or says either flaw is exploited.

Key facts
  • ZDI-26-789 is CVE-2026-63073, rated CVSS 6.5, for information disclosure.
  • The CMP format-string flaw requires no authentication.
  • ZDI-26-790 is CVE-2026-34182, rated CVSS 3.1.
  • The CMS flaw requires a prior ability to modify AuthEnvelopedData messages.
  • No affected or fixed versions are named, and exploitation is not reported.
Analyze CVE-2026-63073 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 22, 2026ZDI publishes OpenSSL CMP and CMS advisories · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • ZDI Published AdvisoriesBoth advisory IDs, CVSS scores, and attack preconditions
CVEs
CVE-2026-63073CVE-2026-34182
Vendors
OpenSSL
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 9d ago ZDI Published AdvisoriesFirst report

    OpenSSL CMP format-string flaw can leak data without login

    ZDI rates CVE-2026-63073 at CVSS 6.5; remote attackers need no authentication, and no fixed version is named.

  2. · 9d ago ZDI Published Advisories

    OpenSSL CMS integrity-check flaw lets attackers tamper with messages

    ZDI rates CVE-2026-34182 at CVSS 3.1 and says the attacker must already be able to modify the messages.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-34182
Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of…
9.1<1%
CVE-2026-63073
Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`
9.8<1%