CVE-2026-35188

Issue summary: A malicious server can exploit TLS OCSP stapling by delivering<br /> a crafted response through the status_request extension, triggering a<br /> double-free in the client&amp;#39;s certificate verification path.<br /> <br /> Impact summary: Successful exploitation allows an attacker to corrupt heap<br /> memory via a double-free, potentially leading to a Denial of Service or<br /> possibly an attacker controlled code execution or other undefined behavior.<br /> <br /> If OCSP stapling is enabled and the TLS client connects to a malicious server,<br /> a crafted OCSP stapled response can trigger a double free in the TLS client<br /> when the stapled response is checked.<br /> <br /> The OCSP stapling is not enabled by default. Reliable code execution<br /> through a double-free is technically complex and highly environment-dependent<br /> but the Denial of Service impact is straightforward to achieve, warranting<br /> Moderate severity.<br /> <br /> No FIPS modules are affected by this issue as the affected code is outside<br /> the OpenSSL FIPS module boundary.