{"id":"CVE-2026-107496","published":"2026-11-10T19:18:02.583","lastModified":"2026-11-10T22:10:04.727","description":"Issue summary: Encrypting a CMS message to an EC certificate whose group order\nis 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.\n\nImpact summary: An attacker able to supply the recipient certificate to an\napplication performing CMS encryption can cause that application to loop\nindefinitely, consuming CPU and resulting in Denial of Service.\n\nCWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')\n\nDescription: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or\nmore recipient certificates and, for an EC recipient, generate an ephemeral\nkey in the recipient's group. If the certificate declares a group order of 1,\nrandom scalar generation can only produce zero. The key generation routine\nthen retries without limit while waiting for a nonzero private scalar, so the\ncall never returns.\n\nThe OpenSSL TLS and QUIC implementations do not use this path. An application\nis exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient\ncertificate whose EC parameters are attacker-controlled. Certificates with\nnormal EC group orders do not trigger the loop.\n\nOpenSSL 4.0 and later reject unknown explicit EC groups in default builds.\nThese versions are affected only when configured with the\nenable-ec_explicit_curves option.\n\nThe result is a hang that consumes a CPU core until the process is\ninterrupted, a Denial of Service. The severity is Low because the attacker\nmust supply the recipient certificate and the application must choose to\nencrypt to it; ordinary CMS encryption to trusted recipients is unaffected.\n\nThe fix makes EC key generation fail when the group has no valid nonzero\nprivate scalar, instead of retrying indefinitely.\n\nFIPS impact: no\nThe FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider\ndoes not support arbitrary explicit EC domain parameters, so an order-1 group\nis rejected during key import before the vulnerable key generation path is\nreached.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-835"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","tags":[]},{"url":"https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","tags":[]},{"url":"https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","tags":[]},{"url":"https://openssl-library.org/news/secadv/20261110.txt","tags":[]}],"exploitRefs":[{"url":"https://github.com/openssl/openssl/commit/36e15b618decdff1b116eead6747718e6e729ad2","tags":[]},{"url":"https://github.com/openssl/openssl/commit/a0051cfe699bf5a047bc1c4faef65f80f7987366","tags":[]},{"url":"https://github.com/openssl/openssl/commit/a8531368ddb1f86d2a2782a8b693926bb67b59e7","tags":[]}],"hasPoc":true,"ai":null}