Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Red Hat issued a security advisory for Red Hat Hardened Images RPMs, including updates to OpenSSL 3.5.8 packages. Among the addressed vulnerabilities is CVE-2026-63074, a flaw in OpenSSL's Certificate Management Protocol (CMP) implementation. The flaw causes the CMP server to retain cached additional certificates when invalid messages are received, resulting in indefinite cache growth and excessive memory consumption. This can be exploited by an attacker sending repeated invalid CMP requests with unique extra certificates, causing a denial of service. The vulnerability is rated low severity by Red Hat due to its specific conditions and limited impact scope. The advisory includes updated RPMs for openssl3, openssl3-devel, openssl3-devel-engine, and openssl3-libs for aarch64 and x86_64 architectures. No exploits in the wild are known. The advisory references multiple CVEs and provides links for further details and update instructions.

The primary impact is a denial of service condition caused by resource exhaustion (memory consumption) on CMP servers using OpenSSL. Attackers can cause the server to consume excessive memory by sending repeated invalid CMP messages containing unique additional certificates. This affects availability but does not impact confidentiality or integrity. The vulnerability requires an attacker to repeatedly send crafted messages and only affects CMP servers with long-lived context objects. No known active exploitation has been reported.

Red Hat has released updated RPM packages for OpenSSL 3.5.8 (openssl3, openssl3-devel, openssl3-devel-engine, openssl3-libs) that address these vulnerabilities. Users should apply these updates as per Red Hat's instructions available at https://images.redhat.com/. No alternative mitigations are currently available or meet Red Hat's criteria for ease of use and applicability. Customers are advised to upgrade to the fixed versions to remediate the issue. For further assistance, contact Red Hat Product Security.