https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:12:49 +0000 https://vulnerability.circl.lu/vuln/cve-2026-35188 <p><strong>Affected:</strong> OpenSSL</p> <p>Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client&#39;s certificate verification path.</p> <p>Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution or other undefined behavior.</p> <p>If OCSP stapling is enabled and the TLS client connects to a malicious server, a crafted OCSP stapled response can trigger a double free in the TLS client when the stapled response is checked.</p> <p>The OCSP stapling is not enabled by default. Reliable code execution through a double-free is technically complex and highly environment-dependent but the Denial of Service impact is straightforward to achieve, warranting Moderate severity.</p> <p>No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.</p> <p><strong>Affected:</strong> OpenSSL</p> <p>Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client&#39;s certificate verification path.</p> <p>Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution or other undefined behavior.</p> <p>If OCSP stapling is enabled and the TLS client connects to a malicious server, a crafted OCSP stapled response can trigger a double free in the TLS client when the stapled response is checked.</p> <p>The OCSP stapling is not enabled by default. Reliable code execution through a double-free is technically complex and highly environment-dependent but the Denial of Service impact is straightforward to achieve, warranting Moderate severity.</p> <p>No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.</p> https://vulnerability.circl.lu/vuln/cve-2026-35188