CVE-2026-35189Excessive Memory Allocation in Relative CRLDP Processing
Updated under an hour ago ()
Does this affect you?
It affects OpenSSL. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module boundary.
- CVSS
- 5.3 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness (CWE)
- CWE-770
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openssl
- NVD analysis
- Analyzed
- Record last updated
- Sep 30, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
OpenSSL OpenSSL openssl:openssl (from the name) | from 4.0.0 before 4.0.3; from 3.6.0 before 3.6.5; from 3.5.0 before 3.5.9; from 3.4.0 before 3.4.8; from 3.0.0 before 3.0.23; from 1.1.1 before 1.1.1zj; from 1.0.2 before 1.0.2zs | CNA record |
openssl openssl openssl:openssl | from 1.0.2 before 1.0.2zs; from 1.1.1 before 1.1.1zj; from 3.0.0 before 3.0.23; from 3.4.0 before 3.4.8; from 3.5.0 before 3.5.9; from 3.6.0 before 3.6.5; from 4.0.0 before 4.0.3 | NVD |
References
- https://openssl-library.org/news/secadv/20260929.txtvendor-advisory
- https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84patch
- https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473fpatch
- https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89patch
- https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.