CVE-2026-35188
Description
A flaw was found in OpenSSL. A malicious server can exploit the TLS Online Certificate Status Protocol (OCSP) stapling feature by sending a specially crafted response. This can trigger a double-free vulnerability in the client's certificate verification process, potentially leading to a Denial of Service (DoS) or, with greater technical complexity, arbitrary code execution. This issue occurs when OCSP stapling is enabled, which is not the default configuration.
Statement
A Moderate severity double-free flaw exists in the TLS client's certificate verification path when processing OCSP stapled responses. This issue, while not enabled by default, could lead to a denial of service or potentially arbitrary code execution if a client connects to a malicious server with OCSP stapling enabled. The complexity of achieving reliable code execution contributes to its Moderate rating, though denial of service is more readily exploitable.
Mitigation
To mitigate this issue, ensure that OCSP stapling is disabled. As OCSP stapling is not enabled by default, no action is required unless it has been explicitly configured. If OCSP stapling has been enabled, consult the documentation for your specific application or service to disable it. Disabling OCSP stapling may affect the real-time revocation status checking of certificates.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | Low |
| Integrity Impact | None | N/A | Low |
| Availability Impact | High | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
