CVE-2026-35188

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35188", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "state": "PUBLISHED", "assignerShortName": "openssl", "dateReserved": "2026-04-01T17:36:26.323Z", "datePublished": "2026-06-09T16:03:24.395Z", "dateUpdated": "2026-06-10T20:02:41.587Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.3", "status": "affected", "version": "3.6.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Wang Kenaz (University of Illinois)"}, {"lang": "en", "type": "reporter", "value": "Guido Vranken (Aisle Research)"}, {"lang": "en", "type": "reporter", "value": "Aaron Grattafiori (Nvidia)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Kubec"}], "datePublic": "2026-06-09T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Issue summary: A malicious server can exploit TLS OCSP stapling by delivering<br>a crafted response through the status_request extension, triggering a<br>double-free in the client's certificate verification path.<br><br>Impact summary: Successful exploitation allows an attacker to corrupt heap<br>memory via a double-free, potentially leading to a Denial of Service or<br>possibly an attacker controlled code execution or other undefined behavior.<br><br>If OCSP stapling is enabled and the TLS client connects to a malicious server,<br>a crafted OCSP stapled response can trigger a double free in the TLS client<br>when the stapled response is checked.<br><br>The OCSP stapling is not enabled by default. Reliable code execution<br>through a double-free is technically complex and highly environment-dependent<br>but the Denial of Service impact is straightforward to achieve, warranting<br>Moderate severity.<br><br>No FIPS modules are affected by this issue as the affected code is outside<br>the OpenSSL FIPS module boundary."}], "value": "Issue summary: A malicious server can exploit TLS OCSP stapling by delivering\na crafted response through the status_request extension, triggering a\ndouble-free in the client's certificate verification path.\n\nImpact summary: Successful exploitation allows an attacker to corrupt heap\nmemory via a double-free, potentially leading to a Denial of Service or\npossibly an attacker controlled code execution or other undefined behavior.\n\nIf OCSP stapling is enabled and the TLS client connects to a malicious server,\na crafted OCSP stapled response can trigger a double free in the TLS client\nwhen the stapled response is checked.\n\nThe OCSP stapling is not enabled by default. Reliable code execution\nthrough a double-free is technically complex and highly environment-dependent\nbut the Denial of Service impact is straightforward to achieve, warranting\nModerate severity.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}], "metrics": [{"format": "other", "other": {"content": {"text": "Moderate"}, "type": "https://openssl-library.org/policies/general/security-policy/"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-415", "description": "CWE-415 Double Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-06-10T07:47:57.674Z"}, "references": [{"name": "OpenSSL Advisory", "tags": ["vendor-advisory"], "url": "https://openssl-library.org/news/secadv/20260609.txt"}, {"name": "4.0.1 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/78d0154cffda03aaaac63a087cc523a6b35fa8fd"}, {"name": "3.6.3 git commit", "tags": ["patch"], "url": "https://github.com/openssl/openssl/commit/131145d25659e8749a9ed1afb383484854cffb78"}], "source": {"discovery": "UNKNOWN"}, "title": "Double-free When Checking OCSP Stapled Response", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-10T03:59:37.106557Z", "id": "CVE-2026-35188", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T20:02:41.587Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-35188", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T03:59:37.106557Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T10:33:35.427Z"}}], "cna": {"title": "Double-free When Checking OCSP Stapled Response", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Wang Kenaz (University of Illinois)"}, {"lang": "en", "type": "reporter", "value": "Guido Vranken (Aisle Research)"}, {"lang": "en", "type": "reporter", "value": "Aaron Grattafiori (Nvidia)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Kubec"}], "metrics": [{"other": {"type": "https://openssl-library.org/policies/general/security-policy/", "content": {"text": "Moderate"}}, "format": "other"}], "affected": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.0.1", "versionType": "semver"}, {"status": "affected", "version": "3.6.0", "lessThan": "3.6.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-06-09T14:00:00.000Z", "references": [{"url": "https://openssl-library.org/news/secadv/20260609.txt", "name": "OpenSSL Advisory", "tags": ["vendor-advisory"]}, {"url": "https://github.com/openssl/openssl/commit/78d0154cffda03aaaac63a087cc523a6b35fa8fd", "name": "4.0.1 git commit", "tags": ["patch"]}, {"url": "https://github.com/openssl/openssl/commit/131145d25659e8749a9ed1afb383484854cffb78", "name": "3.6.3 git commit", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Issue summary: A malicious server can exploit TLS OCSP stapling by delivering\na crafted response through the status_request extension, triggering a\ndouble-free in the client's certificate verification path.\n\nImpact summary: Successful exploitation allows an attacker to corrupt heap\nmemory via a double-free, potentially leading to a Denial of Service or\npossibly an attacker controlled code execution or other undefined behavior.\n\nIf OCSP stapling is enabled and the TLS client connects to a malicious server,\na crafted OCSP stapled response can trigger a double free in the TLS client\nwhen the stapled response is checked.\n\nThe OCSP stapling is not enabled by default. Reliable code execution\nthrough a double-free is technically complex and highly environment-dependent\nbut the Denial of Service impact is straightforward to achieve, warranting\nModerate severity.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.", "supportingMedia": [{"type": "text/html", "value": "Issue summary: A malicious server can exploit TLS OCSP stapling by delivering<br>a crafted response through the status_request extension, triggering a<br>double-free in the client's certificate verification path.<br><br>Impact summary: Successful exploitation allows an attacker to corrupt heap<br>memory via a double-free, potentially leading to a Denial of Service or<br>possibly an attacker controlled code execution or other undefined behavior.<br><br>If OCSP stapling is enabled and the TLS client connects to a malicious server,<br>a crafted OCSP stapled response can trigger a double free in the TLS client<br>when the stapled response is checked.<br><br>The OCSP stapling is not enabled by default. Reliable code execution<br>through a double-free is technically complex and highly environment-dependent<br>but the Denial of Service impact is straightforward to achieve, warranting<br>Moderate severity.<br><br>No FIPS modules are affected by this issue as the affected code is outside<br>the OpenSSL FIPS module boundary.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2026-06-10T07:47:57.674Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35188", "state": "PUBLISHED", "dateUpdated": "2026-06-10T20:02:41.587Z", "dateReserved": "2026-04-01T17:36:26.323Z", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "datePublished": "2026-06-09T16:03:24.395Z", "assignerShortName": "openssl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [{"lessThan": "4.0.1", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "3.6.3", "status": "affected", "version": "3.6.0", "versionType": "semver"}]}], "source": "openssl-security@openssl.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F", "versionEndExcluding": "3.6.3", "versionStartIncluding": "3.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Issue summary: A malicious server can exploit TLS OCSP stapling by delivering\na crafted response through the status_request extension, triggering a\ndouble-free in the client's certificate verification path.\n\nImpact summary: Successful exploitation allows an attacker to corrupt heap\nmemory via a double-free, potentially leading to a Denial of Service or\npossibly an attacker controlled code execution or other undefined behavior.\n\nIf OCSP stapling is enabled and the TLS client connects to a malicious server,\na crafted OCSP stapled response can trigger a double free in the TLS client\nwhen the stapled response is checked.\n\nThe OCSP stapling is not enabled by default. Reliable code execution\nthrough a double-free is technically complex and highly environment-dependent\nbut the Denial of Service impact is straightforward to achieve, warranting\nModerate severity.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary."}, {"lang": "es", "value": "Resumen del problema: Un servidor malicioso puede explotar el 'TLS OCSP stapling' entregando una respuesta manipulada a trav\u00e9s de la 'extension status_request', desencadenando un 'double-free' en la ruta de verificaci\u00f3n de certificados del cliente.\n\nResumen del impacto: La explotaci\u00f3n exitosa permite a un atacante corromper la memoria 'heap' a trav\u00e9s de un 'double-free', lo que podr\u00eda llevar a una denegaci\u00f3n de servicio o posiblemente a una ejecuci\u00f3n de c\u00f3digo controlada por el atacante u otro comportamiento indefinido.\n\nSi el 'OCSP stapling' est\u00e1 habilitado y el cliente TLS se conecta a un servidor malicioso, una respuesta 'OCSP stapled' manipulada puede desencadenar un 'double free' en el cliente TLS cuando se verifica la respuesta 'stapled'.\n\nEl 'OCSP stapling' no est\u00e1 habilitado por defecto. La ejecuci\u00f3n de c\u00f3digo fiable a trav\u00e9s de un 'double-free' es t\u00e9cnicamente compleja y altamente dependiente del entorno, pero el impacto de denegaci\u00f3n de servicio es sencillo de lograr, lo que justifica una severidad Moderada.\n\nNing\u00fan m\u00f3dulo FIPS se ve afectado por este problema, ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL."}], "id": "CVE-2026-35188", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35188", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T03:59:37.106557Z", "version": "2.0.3"}}]}, "published": "2026-06-09T17:17:05.437", "references": [{"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/131145d25659e8749a9ed1afb383484854cffb78"}, {"source": "openssl-security@openssl.org", "tags": ["Patch"], "url": "https://github.com/openssl/openssl/commit/78d0154cffda03aaaac63a087cc523a6b35fa8fd"}, {"source": "openssl-security@openssl.org", "tags": ["Vendor Advisory"], "url": "https://openssl-library.org/news/secadv/20260609.txt"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "openssl-security@openssl.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.6.0,3.6.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenSSL", "source": "cna", "vendor": "OpenSSL"}, "product": "openssl", "vendor": "openssl"}], "created": "2026-06-09T17:30:10.517534+00:00", "updated": "2026-06-10T23:45:44.316768+00:00", "vendors": ["openssl", "openssl$PRODUCT$openssl"]}