5.3

CVE-2026-35189

Excessive Memory Allocation in Relative CRLDP Processing

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL
distribution points causes disproportionate heap growth when OpenSSL caches
X.509 extensions.

Impact summary: Receiving a crafted certificate from a malicious peer can lead
to significant memory pressure and possible Denial of Service in clients or
in servers that solicit client certificates.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: A certificate or a set of certificates that fits under the limit for
size of certificates accepted from the peer (~100 KiB) can result in allocation
of several hundred MiB of resident memory on the receiving side
during a normal TLS handshake.  This may be enough to crash the client or
server, if multiple concurrent connections lead to similarly large memory
allocations.

The fix postpones processing of the CRL distribution points extensions in
certificates to the time when the processed value is required for CRL processing.
This avoids keeping large memory allocations for a long time when such
certificates are received.

FIPS impact: no
The affected code is outside the FIPS module boundary.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version >= 1.0.2 < 1.0.2zs
OpenSSL ≫ OpenSSL Version >= 1.1.1 < 1.1.1zj
OpenSSL ≫ OpenSSL Version >= 3.0.0 < 3.0.23
OpenSSL ≫ OpenSSL Version >= 3.4.0 < 3.4.8
OpenSSL ≫ OpenSSL Version >= 3.5.0 < 3.5.9
OpenSSL ≫ OpenSSL Version >= 3.6.0 < 3.6.5
OpenSSL ≫ OpenSSL Version >= 4.0.0 < 4.0.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.17
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84
Patch
https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89
Patch
https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f
Patch
https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9
Patch
https://openssl-library.org/news/secadv/20260929.txt
Vendor Advisory