CVE-2026-35189 in OpenSSL
Summary
by MITRE • 09/29/2026
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions.
Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations.
The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received.
FIPS impact: no The affected code is outside the FIPS module boundary.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability described involves a significant resource management flaw within OpenSSL, specifically concerning the handling of Certificate Revocation List (CRL) distribution points in X.509 certificates. When an application receives a certificate containing multiple nameRelativeToCRLIssuer CRL distribution point extensions, OpenSSL's internal caching mechanism for X.509 extensions allocates memory to store these values immediately upon parsing. This behavior is problematic because the allocated memory can grow disproportionately relative to the actual size of the incoming certificate file. While the raw certificate data might remain under standard acceptance thresholds, such as one hundred kilobytes, the processed and cached representation in memory can expand to several hundred megabytes. This discrepancy arises from how OpenSSL expands and stores these specific extension fields during the initial handshake phase rather than deferring their processing until they are strictly necessary for validation logic.
This technical flaw directly maps to CWE-770, which defines Allocation of Resources Without Limits or Throttling. The core issue is not a buffer overflow or code execution vulnerability but rather an unbounded memory allocation triggered by specific certificate structures. During a standard Transport Layer Security handshake, the receiving party must parse and cache various extensions from the peer's certificate to facilitate subsequent cryptographic operations. In this scenario, the caching logic fails to account for the potential size inflation of certain extension types, leading to excessive heap growth. This behavior is particularly dangerous in server environments that solicit client certificates or in high-throughput clients connecting to multiple servers simultaneously, as each connection may trigger similar large memory allocations concurrently.
The operational impact of this vulnerability centers on resource exhaustion and Denial of Service conditions. If a malicious peer presents a crafted certificate designed to exploit this caching behavior, the target system can experience severe memory pressure. In environments with limited available RAM or strict memory limits, such as embedded systems or containers with constrained resources, this sudden spike in heap usage can cause the application process to crash due to out-of-memory errors. Even in more robust server deployments, if multiple concurrent connections involve certificates with these problematic extensions, the cumulative effect can degrade system performance significantly or lead to a complete service outage. This represents a classic resource exhaustion attack vector where an attacker leverages legitimate protocol mechanics to destabilize the target infrastructure without needing to exploit code execution flaws.
From a threat modeling perspective, this vulnerability aligns with ATT&CK techniques related to Resource Hijacking and Denial of Service. Attackers can utilize this flaw as part of a broader campaign to disrupt availability services or potentially probe for system stability weaknesses. The fact that the affected code resides outside the FIPS module boundary means that systems relying on strict Federal Information Processing Standards compliance are not directly impacted by this specific memory allocation issue, although general security hygiene remains critical. Mitigation strategies primarily involve applying vendor-provided patches that modify OpenSSL to defer the processing and caching of CRL distribution point extensions until they are actually required for certificate validation checks. This change ensures that large allocations are transient rather than persistent during the handshake phase. Administrators should ensure their systems are updated with versions containing this fix, particularly if they operate servers or clients that process certificates from untrusted or semi-trusted sources where crafted inputs might be expected in adversarial contexts.