Memory Pressure Vulnerability in OpenSSL Affects Multiple Versions
CVE-2026-35189

5.3MEDIUM

Key Information:

Vendor

OpenSSL
Status
OpenSSL
Vendor
CVE Published:
29 September 2026

What is CVE-2026-35189?

A vulnerability in OpenSSL allows targeted exploitation of certificate processing during TLS handshakes. Specifically, a crafted certificate containing numerous nameRelativeToCRLIssuer CRL distribution points can lead to excessive heap memory growth, resulting in significant memory pressure on both client and server systems. This condition may crash affected systems by exhausting memory resources, particularly when handling multiple concurrent connections. The vulnerability is mitigated by deferring the processing of CRL distribution points extensions until they are required, thus preventing prolonged high memory allocations.

Affected Version(s)

OpenSSL 4.0.0 < 4.0.3

OpenSSL 3.6.0 < 3.6.5

OpenSSL 3.5.0 < 3.5.9

References

https://openssl-library.org/news/secadv/20260929.txt
vendor-advisory
https://github.com/openssl/openssl/commit/2b93c73b2c70ddc...
patch
https://github.com/openssl/openssl/commit/8e0efc7549b7ff8...
patch

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fuzz0x (ZKSC Institute of Security Research)
Viktor Dukhovni
.