CVE-2026-35188

A flaw was found in OpenSSL. A malicious server can exploit the TLS Online Certificate Status Protocol (OCSP) stapling feature by sending a specially crafted response. This can trigger a double-free vulnerability in the client's certificate verification process, potentially leading to a Denial of Service (DoS) or, with greater technical complexity, arbitrary code execution. This issue occurs when OCSP stapling is enabled, which is not the default configuration.

A Moderate severity double-free flaw exists in the TLS client's certificate verification path when processing OCSP stapled responses. This issue, while not enabled by default, could lead to a denial of service or potentially arbitrary code execution if a client connects to a malicious server with OCSP stapling enabled. The complexity of achieving reliable code execution contributes to its Moderate rating, though denial of service is more readily exploitable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that OCSP stapling is disabled. As OCSP stapling is not enabled by default, no action is required unless it has been explicitly configured. If OCSP stapling has been enabled, consult the documentation for your specific application or service to disable it. Disabling OCSP stapling may affect the real-time revocation status checking of certificates.