Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

The vulnerability (CVE-2026-63074) in OpenSSL CMP implementation arises because cached additional certificates are not cleared when an invalid message is received. This causes indefinite cache growth of extra certificates, leading to excessive memory consumption and potential denial of service. Exploitation requires repeatedly sending invalid CMP messages containing additional certificates to a CMP server with long-lived context objects. Red Hat has released updated OpenSSL RPMs (version 3.5.8-0.1.hum1) for Red Hat Hardened Images to address this and other vulnerabilities. The advisory notes no mitigation other than applying the update, and the vulnerability is rated low severity by Red Hat despite a CVSS base score of 7.5 assigned by Red Hat's internal scoring.

Successful exploitation results in denial of service due to memory exhaustion on CMP servers running vulnerable OpenSSL versions. There is no impact on confidentiality or integrity. The vulnerability requires network access but no privileges or user interaction. It affects availability by allowing resource consumption attacks.

Red Hat has released updated OpenSSL packages (version 3.5.8-0.1.hum1) for Red Hat Hardened Images that include fixes for this vulnerability. Users should apply these updates to remediate the issue. No other mitigations are currently available or meet Red Hat's criteria for ease of use and applicability.