CVE-2026-35188: Double-free When Checking OCSP Stapled Response
Double-free When Checking OCSP Stapled Response
Other sources
Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the statusrequest extension, triggering a double-free in the client's certificate verification path.
Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution or other undefined behavior.
If OCSP stapling is enabled and the TLS client connects to a malicious server, a crafted OCSP stapled response can trigger a double free in the TLS client when the stapled response is checked.
The OCSP stapling is not enabled by default. Reliable code execution through a double-free is technically complex and highly environment-dependent but the Denial of Service impact is straightforward to achieve, warranting Moderate severity.
No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35188?
The severity of CVE-2026-35188 is classified as medium with a CVSS score of 5.
How do I fix CVE-2026-35188?
To fix CVE-2026-35188, update to the latest version of OpenSSL that addresses this vulnerability.
What systems are affected by CVE-2026-35188?
CVE-2026-35188 affects systems that use OpenSSL with the TLS OCSP stapling mechanism enabled.
What impact does CVE-2026-35188 have on application security?
CVE-2026-35188 can allow a malicious server to exploit TLS OCSP stapling, leading to potential heap memory corruption.
How does the double-free vulnerability in CVE-2026-35188 work?
The double-free vulnerability in CVE-2026-35188 occurs when a crafted OCSP response causes the client to free the same memory twice during certificate verification.