Skip to content
Sign in
CVE-2026-351895.3Medium

CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing

OpenSSL

Fixed in Debian 12/13, Alpine 3.21 · Affected: OpenSSL · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not establishedNothing in the sources we check
0.3%probability of exploitation in the next 30 days
24th percentile
050100

Higher than 24% of scored CVEs

5.3MediumCVSS
LowMedium

DescriptionNVD

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module boundary.

Fix status by distribution

From each distribution’s security tracker. Distributions we did not check are not listed.

What changed

Alpine status tracked since 10 Nov 2026. Debian status tracked since 10 Nov 2026. Red Hat status tracked since 10 Nov 2026. SUSE status tracked since 10 Nov 2026.

  1. Seen in Alpine’s tracker on 10 Nov: Alpine 3.21 fixed in openssl-3.3.7-r2 Alpine
  2. Seen in Debian’s tracker on 10 Nov: Debian 12 fixed in openssl 3.0.22-1~deb12u2 (DLA-4859-1) Debian
  3. Seen in Debian’s tracker on 10 Nov: Debian 13 fixed in openssl 3.5.7-1~deb13u3 (DSA-6531-1) Debian
  4. Red Hat’s tracker lists RHEL 10 as affected, with no fix released Red Hat
  5. Red Hat’s tracker lists RHEL 7 as affected, with no fix released Red Hat
  6. Red Hat’s tracker lists RHEL 8 as affected, with no fix released Red Hat
  7. Red Hat’s tracker lists RHEL 9 as affected, with no fix released Red Hat
  8. SUSE’s tracker lists openSUSE Leap 16.0 as not affected SUSE
  9. SUSE’s tracker lists openSUSE Leap 16.1 as not affected SUSE
  10. SUSE’s tracker lists SLES 12 SP5 as not affected SUSE
  11. SUSE’s tracker lists SLES 15 SP1 as not affected SUSE
  12. SUSE’s tracker lists SLES 15 SP2 as not affected SUSE
  13. SUSE’s tracker lists SLES 15 SP3 as not affected SUSE
  14. SUSE’s tracker lists SLES 15 SP4 as not affected SUSE
  15. SUSE’s tracker lists SLES 15 SP5 as not affected SUSE
  16. SUSE’s tracker lists SLES 15 SP6 as not affected SUSE
  17. SUSE’s tracker lists SLES 15 SP7 as not affected SUSE
  18. SUSE’s tracker lists SLES 16.0 as not affected SUSE
  19. SUSE’s tracker lists SLES 16.1 as not affected SUSE

Coverage1 article · 1 outlet

First in our coverage: SecurityOnline, 10 Nov.

  1. Progress fixes five WS_FTP Server flaws exposing sensitive data
    SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in