[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-63073":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":28,"aliases":29,"duplicate_of":9,"upstream":47,"downstream":48,"duplicates":69,"related":70,"reserved_at":9,"published_at":76,"modified_at":77,"state":78,"summary":79,"references_raw":88,"kevs":147,"epss":148,"epss_history":151,"metrics":226,"affected":241},"CVE-2026-63073","Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-134","Use of Externally-Controlled Format String","The product uses a function that accepts a format string as an argument, but the format string originates from an external source.","weakness","Draft","Base","High",[20,24],{"id":21,"name":22,"techniques":23},"CAPEC-135","Format String Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-67","String Format Overflow in syslog()",[],[],[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"DEBIAN-CVE-2026-63073","UBUNTU-CVE-2026-63073","ALPINE-CVE-2026-63073","CGA-2r65-2whv-vg9f","CGA-6r5h-8fv2-r4fc","CGA-7g9v-fwv3-968r","CGA-867p-85m2-g3pf","CGA-9g9c-34mf-x8vv","CGA-9wpw-9gpf-8vgf","CGA-f99f-p537-f846","CGA-gj86-7hr7-fwf9","CGA-jhmg-989j-q2vg","CGA-mq4q-fmrg-3c8r","CGA-p7jc-jw86-5h4w","CGA-r2m6-mcr2-wq38","CGA-v92x-7m68-999q","CGA-wf7j-jh94-xg9c",[],[49,51,53,55,57,59,61,63,65,67],{"_key":50},"OPENSUSE-SU-2026:11623-1",{"_key":52},"MGASA-2026-0353",{"_key":54},"USN-8678-1",{"_key":56},"OPENSUSE-SU-2026:21744-1",{"_key":58},"SUSE-SU-2026:4039-1",{"_key":60},"RHSA-2026:59635",{"_key":62},"RHSA-2026:59641",{"_key":64},"SUSE-SU-2026:23463-1",{"_key":66},"RHSA-2026:67154",{"_key":68},"RHSA-2026:67165",[],[71,72,73,74,75],{"_key":50},{"_key":56},{"_key":58},{"_key":64},{"_key":54},"2026-08-25T12:59:43.356Z","2026-08-31T19:12:54.136Z","Analyzed",{"cisa_kev":80,"cisa_ransomware":80,"cisa_vendor":9,"epss_severity":81,"epss_score":82,"severity":83,"severity_score":84,"severity_version":85,"severity_source":86,"severity_vector":87,"severity_status":78},false,"low",0.00929,"critical",9.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[89,97,103,107,111,115,120,126,130,134,139,143],{"url":90,"sources":91,"tags":94},"https://openssl-library.org/news/secadv/20260825.txt",[86,92,93],"nvd","osv_chainguard",[95,96],"Vendor Advisory","Advisory",{"url":98,"sources":99,"tags":100},"https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21",[86,92,93],[101,102],"Patch","FIX",{"url":104,"sources":105,"tags":106},"https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29",[86,92,93],[101,102],{"url":108,"sources":109,"tags":110},"https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca",[86,92,93],[101,102],{"url":112,"sources":113,"tags":114},"https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4",[86,92,93],[101,102],{"url":116,"sources":117,"tags":119},"https://security-tracker.debian.org/tracker/CVE-2026-63073",[118],"osv_debian",[96],{"url":121,"sources":122,"tags":124},"https://ubuntu.com/security/CVE-2026-63073",[123],"osv_ubuntu",[125],"REPORT",{"url":127,"sources":128,"tags":129},"https://www.cve.org/CVERecord?id=CVE-2026-63073",[123],[125],{"url":131,"sources":132,"tags":133},"https://ubuntu.com/security/notices/USN-8678-1",[123],[96],{"url":135,"sources":136,"tags":138},"https://security.alpinelinux.org/vuln/CVE-2026-63073",[137],"osv_alpine",[96],{"url":140,"sources":141,"tags":142},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63073.json",[93],[96],{"url":144,"sources":145,"tags":146},"https://nvd.nist.gov/vuln/detail/CVE-2026-63073",[93],[96],[],{"date":149,"score":82,"percentile":150},"2026-09-19",0.59051,[152,156,159,162,165,168,171,174,177,180,183,186,189,192,195,198,201,204,207,210,213,216,219,222,225],{"date":153,"score":154,"percentile":155},"2026-08-26",0.00409,0.33866,{"date":157,"score":154,"percentile":158},"2026-08-27",0.33891,{"date":160,"score":154,"percentile":161},"2026-08-28",0.33875,{"date":163,"score":154,"percentile":164},"2026-08-29",0.33907,{"date":166,"score":154,"percentile":167},"2026-08-30",0.33981,{"date":169,"score":154,"percentile":170},"2026-08-31",0.33995,{"date":172,"score":82,"percentile":173},"2026-09-01",0.58129,{"date":175,"score":82,"percentile":176},"2026-09-02",0.58175,{"date":178,"score":82,"percentile":179},"2026-09-03",0.58196,{"date":181,"score":82,"percentile":182},"2026-09-04",0.58228,{"date":184,"score":82,"percentile":185},"2026-09-05",0.57745,{"date":187,"score":82,"percentile":188},"2026-09-06",0.58278,{"date":190,"score":82,"percentile":191},"2026-09-07",0.58284,{"date":193,"score":82,"percentile":194},"2026-09-08",0.58303,{"date":196,"score":82,"percentile":197},"2026-09-09",0.58483,{"date":199,"score":82,"percentile":200},"2026-09-10",0.58502,{"date":202,"score":82,"percentile":203},"2026-09-11",0.58536,{"date":205,"score":82,"percentile":206},"2026-09-12",0.58602,{"date":208,"score":82,"percentile":209},"2026-09-13",0.58597,{"date":211,"score":82,"percentile":212},"2026-09-14",0.5862,{"date":214,"score":82,"percentile":215},"2026-09-15",0.58689,{"date":217,"score":82,"percentile":218},"2026-09-16",0.58832,{"date":220,"score":82,"percentile":221},"2026-09-17",0.58903,{"date":223,"score":82,"percentile":224},"2026-09-18",0.59013,{"date":149,"score":82,"percentile":150},[227,231,233,235,237,239],{"source":86,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":228,"cvss_v4_0":9},{"baseScore":84,"baseSeverity":229,"vectorString":87,"impactScore":84,"exploitabilityScore":230},"CRITICAL",10,{"source":92,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":232,"cvss_v4_0":9},{"baseScore":84,"baseSeverity":229,"vectorString":87,"impactScore":84,"exploitabilityScore":230},{"source":137,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":234,"cvss_v4_0":9},{"baseScore":84,"baseSeverity":9,"vectorString":87,"impactScore":84,"exploitabilityScore":230},{"source":118,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":236,"cvss_v4_0":9},{"baseScore":84,"baseSeverity":9,"vectorString":87,"impactScore":84,"exploitabilityScore":230},{"source":123,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":238,"cvss_v4_0":9},{"baseScore":84,"baseSeverity":9,"vectorString":87,"impactScore":84,"exploitabilityScore":230},{"source":93,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":240,"cvss_v4_0":9},{"baseScore":84,"baseSeverity":9,"vectorString":87,"impactScore":84,"exploitabilityScore":230},[242,265,275,280,285,292,296,300,305,317,323,327,331,336,340],{"ecosystem":243,"name":244,"vendor":245,"product":244,"cpe_part":9,"purl_type":246,"purl_namespace":245,"purl_name":244,"source":9,"versions":247},"Alpine Linux","openssl","alpine","apk",[248,254,255,256,261,263,264],{"version":249,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":252,"version_end_type":253,"fixed_in":9},"lt3_5_8_r0",true,"ecosystem","3.5.8-r0","excluding",{"version":249,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":252,"version_end_type":253,"fixed_in":9},{"version":249,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":252,"version_end_type":253,"fixed_in":9},{"version":257,"is_range":250,"range_type":251,"version_start":258,"version_start_type":259,"version_end":260,"version_end_type":253,"fixed_in":9},"gte3_4_0_lt3_3_7_r1","3.4.0","including","3.3.7-r1",{"version":262,"is_range":250,"range_type":251,"version_start":258,"version_start_type":259,"version_end":252,"version_end_type":253,"fixed_in":9},"gte3_4_0_lt3_5_8_r0",{"version":262,"is_range":250,"range_type":251,"version_start":258,"version_start_type":259,"version_end":252,"version_end_type":253,"fixed_in":9},{"version":262,"is_range":250,"range_type":251,"version_start":258,"version_start_type":259,"version_end":252,"version_end_type":253,"fixed_in":9},{"ecosystem":266,"name":267,"vendor":268,"product":267,"cpe_part":9,"purl_type":246,"purl_namespace":268,"purl_name":267,"source":9,"versions":269},"Chainguard","eco-python-openssl-4","chainguard",[270,272],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"version":273,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":274,"version_end_type":253,"fixed_in":9},"lt4_0_2_r0","4.0.2-r0",{"ecosystem":266,"name":276,"vendor":268,"product":276,"cpe_part":9,"purl_type":246,"purl_namespace":268,"purl_name":276,"source":9,"versions":277},"eco-python-openssl-4-pyca",[278,279],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":273,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":274,"version_end_type":253,"fixed_in":9},{"ecosystem":266,"name":281,"vendor":268,"product":281,"cpe_part":9,"purl_type":246,"purl_namespace":268,"purl_name":281,"source":9,"versions":282},"eco-python-openssl-4-pyca-dev",[283,284],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":273,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":274,"version_end_type":253,"fixed_in":9},{"ecosystem":266,"name":286,"vendor":268,"product":286,"cpe_part":9,"purl_type":246,"purl_namespace":268,"purl_name":286,"source":9,"versions":287},"openssl-provider-fips-3.4.0",[288,289],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":290,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":291,"version_end_type":253,"fixed_in":9},"lt0","0",{"ecosystem":266,"name":293,"vendor":268,"product":293,"cpe_part":9,"purl_type":246,"purl_namespace":268,"purl_name":293,"source":9,"versions":294},"openssl-provider-fips-3.4.0-dbg",[295],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":266,"name":297,"vendor":268,"product":297,"cpe_part":9,"purl_type":246,"purl_namespace":268,"purl_name":297,"source":9,"versions":298},"openssl-provider-fips-3.6.0",[299],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":266,"name":301,"vendor":268,"product":301,"cpe_part":9,"purl_type":246,"purl_namespace":268,"purl_name":301,"source":9,"versions":302},"openssl-provider-fips-3.6.0-dbg",[303,304],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":290,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":291,"version_end_type":253,"fixed_in":9},{"ecosystem":306,"name":244,"vendor":307,"product":244,"cpe_part":9,"purl_type":308,"purl_namespace":307,"purl_name":244,"source":9,"versions":309},"Debian","debian","deb",[310,311,314],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":312,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":313,"version_end_type":253,"fixed_in":9},"lt3_5_7_1~deb13u2","3.5.7-1~deb13u2",{"version":315,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":316,"version_end_type":253,"fixed_in":9},"lt3_6_4_1","3.6.4-1",{"ecosystem":318,"name":319,"vendor":320,"product":319,"cpe_part":9,"purl_type":308,"purl_namespace":320,"purl_name":319,"source":9,"versions":321},"Ubuntu","edk2","ubuntu",[322],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":318,"name":324,"vendor":320,"product":324,"cpe_part":9,"purl_type":308,"purl_namespace":320,"purl_name":324,"source":9,"versions":325},"edk2-hwe",[326],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":318,"name":328,"vendor":320,"product":328,"cpe_part":9,"purl_type":308,"purl_namespace":320,"purl_name":328,"source":9,"versions":329},"nodejs",[330],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":318,"name":244,"vendor":320,"product":244,"cpe_part":9,"purl_type":308,"purl_namespace":320,"purl_name":244,"source":9,"versions":332},[333],{"version":334,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":335,"version_end_type":253,"fixed_in":9},"lt3_5_5_1ubuntu3_4","3.5.5-1ubuntu3.4",{"ecosystem":318,"name":337,"vendor":320,"product":337,"cpe_part":9,"purl_type":308,"purl_namespace":320,"purl_name":337,"source":9,"versions":338},"openssl-fips",[339],{"version":271,"is_range":250,"range_type":251,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":341,"vendor":244,"product":244,"cpe_part":342,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":343},"OpenSSL","a",[344,348,352,356],{"version":345,"is_range":250,"range_type":346,"version_start":258,"version_start_type":259,"version_end":347,"version_end_type":253,"fixed_in":9},"gte3.4.0_lt3.4.7","cpe","3.4.7",{"version":349,"is_range":250,"range_type":346,"version_start":350,"version_start_type":259,"version_end":351,"version_end_type":253,"fixed_in":9},"gte3.5.0_lt3.5.8","3.5.0","3.5.8",{"version":353,"is_range":250,"range_type":346,"version_start":354,"version_start_type":259,"version_end":355,"version_end_type":253,"fixed_in":9},"gte3.6.0_lt3.6.4","3.6.0","3.6.4",{"version":357,"is_range":250,"range_type":346,"version_start":358,"version_start_type":259,"version_end":359,"version_end_type":253,"fixed_in":9},"gte4.0.0_lt4.0.2","4.0.0","4.0.2"]