CVE-2026-35189 Excessive Memory Allocation in Relative CRLDP Processing

What is CVE-2026-35189?

CVE-2026-35189 is a medium-severity denial of service vulnerability in Openssl Openssl, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions.

Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates.

CWE: CWE-770: Allocation of Resources Without Limits or Throttling

Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations.

The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received.

FIPS impact: no The affected code is outside the FIPS module boundary.

Weakness: CWE-770

Which versions are affected by CVE-2026-35189?

It affects 1 product.

Products include Openssl Openssl.

How do I fix CVE-2026-35189?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-35189 being exploited?

There is no known exploitation of CVE-2026-35189 in the wild and no public exploit code.

Other vulnerabilities in Openssl Openssl

• CVE-2009-3245 Null dereference in n/a Critical 10.0
• CVE-2006-3738 Memory corruption in n/a Critical 10.0
• CVE-2026-63073 Untrusted Sender DN Used as Format String in CMP Response Validation Critical 9.8
• CVE-2016-6309 Use after free in n/a Critical 9.8
• CVE-2016-0799 Integer overflow in n/a Critical 9.8

All Openssl Openssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-35189, AZL-105357, AZL-105447, AZL-105474, AZL-105513, AZL-105564 and 13 more.