CVE-2026-35188 Double-free When Checking OCSP Stapled Response
A malicious server can trigger a double-free in OpenSSL clients via crafted OCSP stapled responses, causing denial of service or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35188?
CVE-2026-35188 is a medium-severity use after free vulnerability in Openssl Openssl, published on 9 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path.
Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution or other undefined behavior.
If OCSP stapling is enabled and the TLS client connects to a malicious server, a crafted OCSP stapled response can trigger a double free in the TLS client when the stapled response is checked.
The OCSP stapling is not enabled by default. Reliable code execution through a double-free is technically complex and highly environment-dependent but the Denial of Service impact is straightforward to achieve, warranting Moderate severity.
No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.
Weakness: CWE-415
Which versions are affected by CVE-2026-35188?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2026-35188?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-35188 being exploited?
There is no known exploitation of CVE-2026-35188 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as DEBIAN-CVE-2026-35188, GHSA-vc8w-w49c-4jgj, UBUNTU-CVE-2026-35188.