{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-54876 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-54876 is a high-severity denial of service vulnerability in OpenSSL, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-54876 and fix it if it is affected.\n\nWhat it is: CVE-2026-54876 is a high-severity denial of service vulnerability in OpenSSL, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-54876 in the wild and no public exploit code.\n\nAffected product: OpenSSL. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54876/ (Markdown: https://insights.sbomify.com/CVE-2026-54876/index.md)","id":"CVE-2026-54876","markdown":"https://insights.sbomify.com/CVE-2026-54876/index.md","name":"CVE-2026-54876","record":{"aliases":["CLEANSTART-2026-WR38385","DEBIAN-CVE-2026-54876","GHSA-5cfw-78wc-wvjq","RHSA-2026:57021","UBUNTU-CVE-2026-54876"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"OpenSSL TLS library","requires_auth":"none","summary":"A malicious TLS server can cause memory exhaustion in clients with OCSP checking enabled, leading to denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"openssl","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-401","name":"Missing Release of Memory after Effective Lifetime"}],"description":"Issue summary: A malicious TLS server can cause a memory leak in a TLS\nclient that has enabled OCSP response checking by sending an OCSP\nresponse that contains no single response entries.\n\nImpact summary: An attacker can leak an attacker-tunable amount of memory\nper TLS handshake in a victim client application. A long-running client\nthat repeatedly connects to a malicious server can have its memory\nexhausted, resulting in a Denial of Service.\n\nCWE: CWE-401: Missing Release of Memory after Effective Lifetime\n\nDescription: The affected function is called during X.509 certificate\nchain verification when OCSP response checking is enabled\nwith the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL\nverification flags, for example when a TLS client verifies an OCSP\nresponse stapled into the TLS handshake by the server.\n\nWhen the received BasicOCSPResponse contains an empty SEQUENCE OF\nSingleResponse, which is permitted on the wire and accepted by the\nOpenSSL decoder, the OCSP_BASICRESP structure allocated by\nOCSP_response_get1_basic() was not freed because an early return\nbypassed the cleanup code at the end of the function.\n\nThe amount of memory leaked per handshake can be amplified by the\nattacker by padding the certs field of the BasicOCSPResponse with\nbogus certificates, which are parsed and stored in the leaked\nstructure before the empty response check triggers the early return.\nA long-running TLS client that repeatedly connects to a malicious\nserver can have its memory exhausted over time.\n\nOCSP response checking is not enabled by default. Only client\napplications that explicitly enable the OCSP response check\nverification flags are affected.\n\nFIPS impact: no\n\nThe FIPS modules in 4.0 and 3.6 are not affected by this issue as the\naffected code is outside the OpenSSL FIPS module boundary.","ecosystems":["Red Hat:hummingbird:1"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Client-Side Memory Leak in OCSP Response Checking","id":"CVE-2026-54876","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":4,"n_references":3,"next":{"headline":"Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching","id":"CVE-2026-54885"},"packages":[{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.5.7-2.2.hum1"],"introduced":["0"],"last_affected":[],"package":"openssl3","purl":"pkg:rpm/redhat/openssl3","source":"RHSA-2026:57021"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.5.7-2.2.hum1"],"introduced":["0"],"last_affected":[],"package":"openssl3-devel","purl":"pkg:rpm/redhat/openssl3-devel","source":"RHSA-2026:57021"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.5.7-2.2.hum1"],"introduced":["0"],"last_affected":[],"package":"openssl3-devel-engine","purl":"pkg:rpm/redhat/openssl3-devel-engine","source":"RHSA-2026:57021"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:3.5.7-2.2.hum1"],"introduced":["0"],"last_affected":[],"package":"openssl3-libs","purl":"pkg:rpm/redhat/openssl3-libs","source":"RHSA-2026:57021"}],"prev":{"headline":"Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V","id":"CVE-2026-54875"},"products":["OpenSSL"],"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-05","vendors":["OpenSSL"]},"summary":"A malicious TLS server can cause memory exhaustion in clients with OCSP checking enabled, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-54876/"}