CVE-2026-35189

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service (DoS) by presenting a specially crafted certificate during a Transport Layer Security (TLS) handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List (CRL) distribution points, it allocates an excessive amount of memory. This disproportionate memory usage can exhaust system resources and crash the affected client or server application.

This issue is rated Low because a crafted certificate with many relative CRL distribution points can force large heap allocations during X.509 extension caching, leading to memory pressure or denial of service in TLS clients or servers that request client certificates. There is no confidentiality or integrity impact. The vulnerable code is outside the FIPS module.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Limit acceptance of untrusted peer certificates and keep certificate size/chain limits conservative in TLS services. Prefer not enabling client-certificate authentication unless required.