{"id":"CVE-2026-107496","kind":"vulnerability","aliases":["CVE-2026-107496"],"related":[],"title":"OpenSSL: CMS encryption to crafted EC certificate hangs process indefinitely","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached.","summary":"Encrypting a CMS message to an EC recipient certificate whose group order is 1 makes CMS_encrypt() or CMS_encrypt_ex() loop forever. An attacker who can supply the recipient certificate can use this to consume a CPU core and cause denial of service.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","denial-of-service","ec-certificates","openssl","package"],"not_affected_if":["fips-provider","no-cms-encryption","tls-only","trusted-recipients-only"],"how_to_check":"- Check whether the application calls `CMS_encrypt()` or `CMS_encrypt_ex()` with recipient certificates that an outside party can supply.\n- Check the OpenSSL version with `openssl version`; affected builds are listed in the sources.\n- For OpenSSL 4.0 and later, check whether the build enables `enable-ec_explicit_curves`.","fix":null,"status":"open","published_at":"2026-11-10T19:18:02+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","triaged_at":"2026-11-10T20:04:54+00:00","updated_at":"2026-11-10T20:04:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T20:04:54Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a patched OpenSSL release as stated by the vendor; the exact fixed versions for each branch are not listed in the sources provided.","reach":"network","title":"OpenSSL: CMS encryption to crafted EC certificate hangs process indefinitely","impact":"low","summary":"Encrypting a CMS message to an EC recipient certificate whose group order is 1 makes CMS_encrypt() or CMS_encrypt_ex() loop forever. An attacker who can supply the recipient certificate can use this to consume a CPU core and cause denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["openssl","cms","ec-certificates","denial-of-service"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Process hangs and consumes a CPU core until interrupted.","analyst_note":"Confirm the fixed OpenSSL versions per branch from the NVD entry or the linked patch commits; the sources here give no version list.","how_to_check":"- Check whether the application calls `CMS_encrypt()` or `CMS_encrypt_ex()` with recipient certificates that an outside party can supply.\n- Check the OpenSSL version with `openssl version`; affected builds are listed in the sources.\n- For OpenSSL 4.0 and later, check whether the build enables `enable-ec_explicit_curves`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-cms-encryption","trusted-recipients-only","tls-only","fips-provider"],"who_is_affected":"Applications that encrypt CMS messages to recipient certificates an attacker can supply, such as services accepting uploaded certificates. OpenSSL TLS and QUIC are not affected; OpenSSL 4.0 and later are affected only when built with enable-ec_explicit_curves; the FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000883,"input_tokens":5196,"output_tokens":727,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1':375C '-107496':13A,16A '-2026':12A,15A '-835':130C '1':40B,85C,176C '3.0':357C '3.5':355C '4.0':252C,354C '4.1':353C 'abl':101C 'affect':266C,360C 'applic':109C,116C,216C,311C 'arbitrari':367C 'attack':51B,100C,238C,303C 'attacker-control':237C 'build':262C 'call':201C,222C 'caus':67B,87C,114C 'certif':7A,24B,35B,57B,80C,106C,153C,170C,232C,240C,308C 'choos':313C 'cms':2A,17B,29B,42B,45B,75C,88C,91C,111C,139C,142C,223C,226C,319C 'condit':135C 'configur':269C 'consum':62B,120C,284C 'control':239C 'core':65B,287C 'cpu':64B,121C,286C 'craft':5A 'curv':276C 'cve':11A,14A 'cwe':128C,129C 'declar':171C 'default':261C 'denial':19B,68B,125C,294C 'denial-of-servic':18B 'descript':138C 'domain':370C 'ec':6A,23B,33B,79C,157C,234C,243C,258C,274C,329C,369C 'ec-certif':22B 'enabl':273C 'enable-ec':272C 'encrypt':3A,27B,43B,46B,73C,89C,92C,112C,140C,143C,145C,224C,227C,315C,320C 'ephemer':161C 'ex':47B,93C,144C,228C 'exit':134C 'explicit':257C,275C,368C 'expos':218C 'fail':332C 'fip':346C,350C,362C 'fix':327C 'forev':49B 'generat':159C,179C,186C,331C,386C 'group':37B,82C,167C,173C,244C,259C,335C,376C 'hang':8A,282C 'impact':97C,347C 'implement':209C 'import':381C 'indefinit':10A,96C,119C,345C 'infinit':136C 'instead':342C 'interrupt':292C 'issu':71C 'key':162C,185C,330C,380C,385C 'later':254C 'limit':191C 'loop':48B,95C,118C,131C,137C,250C 'low':300C 'make':41B,328C 'may':86C 'messag':30B,76C,147C 'modul':351C 'must':304C,312C 'never':202C 'nonzero':196C,339C 'normal':242C 'one':149C 'openssl':1A,25B,205C,251C 'option':277C 'order':38B,83C,174C,245C,374C 'ordinari':318C 'packag':26B 'paramet':235C,371C 'path':214C,387C 'perform':110C 'privat':197C,340C 'process':9A,290C 'produc':182C 'provid':363C 'quic':208C 'random':177C 'reach':389C 'recipi':34B,56B,105C,152C,158C,165C,231C,307C,323C 'reject':255C,378C 'result':123C,279C 'retri':189C,344C 'return':203C 'routin':187C 'scalar':178C,198C,341C 'servic':21B,70B,127C,296C 'sever':298C 'summari':72C,98C 'suppli':54B,103C,305C 'support':366C 'tls':206C 'trigger':248C 'trust':322C 'unaffect':325C 'unknown':256C 'unreach':133C 'use':59B,212C 'valid':338C 'version':264C 'vulner':384C 'wait':193C 'whose':36B,81C,233C 'without':190C 'zero':183C","nicknames":[],"mitigations":[],"who_affected":"Applications that encrypt CMS messages to recipient certificates an attacker can supply, such as services accepting uploaded certificates. OpenSSL TLS and QUIC are not affected; OpenSSL 4.0 and later are affected only when built with enable-ec_explicit_curves; the FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","denialofservice","eccertificates","low","openssl","package"],"campaign_type":null,"search_a":"'-107496':13A,16A '-2026':12A,15A 'certif':7A 'cms':2A 'craft':5A 'cve':11A,14A 'ec':6A 'encrypt':3A 'hang':8A 'indefinit':10A 'openssl':1A 'process':9A","search_b":"'1':40B 'attack':51B 'caus':67B 'certif':24B,35B,57B 'cms':17B,29B,42B,45B 'consum':62B 'core':65B 'cpu':64B 'denial':19B,68B 'denial-of-servic':18B 'ec':23B,33B 'ec-certif':22B 'encrypt':27B,43B,46B 'ex':47B 'forev':49B 'group':37B 'loop':48B 'make':41B 'messag':30B 'openssl':25B 'order':38B 'packag':26B 'recipi':34B,56B 'servic':21B,70B 'suppli':54B 'use':59B 'whose':36B","search_c":"'-1':375C '-835':130C '1':85C,176C '3.0':357C '3.5':355C '4.0':252C,354C '4.1':353C 'abl':101C 'affect':266C,360C 'applic':109C,116C,216C,311C 'arbitrari':367C 'attack':100C,238C,303C 'attacker-control':237C 'build':262C 'call':201C,222C 'caus':87C,114C 'certif':80C,106C,153C,170C,232C,240C,308C 'choos':313C 'cms':75C,88C,91C,111C,139C,142C,223C,226C,319C 'condit':135C 'configur':269C 'consum':120C,284C 'control':239C 'core':287C 'cpu':121C,286C 'curv':276C 'cwe':128C,129C 'declar':171C 'default':261C 'denial':125C,294C 'descript':138C 'domain':370C 'ec':79C,157C,234C,243C,258C,274C,329C,369C 'enabl':273C 'enable-ec':272C 'encrypt':73C,89C,92C,112C,140C,143C,145C,224C,227C,315C,320C 'ephemer':161C 'ex':93C,144C,228C 'exit':134C 'explicit':257C,275C,368C 'expos':218C 'fail':332C 'fip':346C,350C,362C 'fix':327C 'generat':159C,179C,186C,331C,386C 'group':82C,167C,173C,244C,259C,335C,376C 'hang':282C 'impact':97C,347C 'implement':209C 'import':381C 'indefinit':96C,119C,345C 'infinit':136C 'instead':342C 'interrupt':292C 'issu':71C 'key':162C,185C,330C,380C,385C 'later':254C 'limit':191C 'loop':95C,118C,131C,137C,250C 'low':300C 'make':328C 'may':86C 'messag':76C,147C 'modul':351C 'must':304C,312C 'never':202C 'nonzero':196C,339C 'normal':242C 'one':149C 'openssl':205C,251C 'option':277C 'order':83C,174C,245C,374C 'ordinari':318C 'paramet':235C,371C 'path':214C,387C 'perform':110C 'privat':197C,340C 'process':290C 'produc':182C 'provid':363C 'quic':208C 'random':177C 'reach':389C 'recipi':105C,152C,158C,165C,231C,307C,323C 'reject':255C,378C 'result':123C,279C 'retri':189C,344C 'return':203C 'routin':187C 'scalar':178C,198C,341C 'servic':127C,296C 'sever':298C 'summari':72C,98C 'suppli':103C,305C 'support':366C 'tls':206C 'trigger':248C 'trust':322C 'unaffect':325C 'unknown':256C 'unreach':133C 'use':212C 'valid':338C 'version':264C 'vulner':384C 'wait':193C 'whose':81C,233C 'without':190C 'zero':183C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107496","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107496","severity":null,"published_at":"2026-11-10T19:18:02+00:00","modified_at":"2026-11-10T19:18:02+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","fetched_at":"2026-11-10T19:24:21+00:00","note":null}],"documents":[{"id":117365,"url":"https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117366,"url":"https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117367,"url":"https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}