The vulnerability occurs in CMP clients that revoke certificates by supplying a PKCS#10 CSR instead of the certificate or issuer name and serial number. Since a CSR lacks issuer name and serial number, the client sends neither. If a CMP server returns a revocation response naming the revoked certificate, the client attempts to compare the server's name to what it sent. Without issuer name or serial number, this results in a NULL pointer dereference and client crash. The revocation response is validated for message protection before this code is reached, so exploitation requires a malicious or compromised CMP server or a man-in-the-middle with access to the message protection secret. Clients using certificate or issuer and serial number for revocation are not affected. The issue is classified as CWE-476 (NULL pointer dereference) and has a CVSS 3.1 base score of 5.3 (medium severity). No FIPS modules are affected.

Successful exploitation causes a denial of service by crashing the CMP client application due to a NULL pointer dereference when processing a crafted revocation response. There is no confidentiality or integrity impact. Exploitation requires control of or access to a CMP server or the message protection secret, limiting the threat to malicious or compromised servers or privileged man-in-the-middle attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using CMP clients with PKCS#10 CSR-based revocation requests against untrusted CMP servers. Use revocation requests that identify certificates by certificate or issuer and serial number, which are not affected by this issue.