CVE-2026-35189: OpenSSL Certificate DOS Vulnerability

CVE-2026-35189 Overview

CVE-2026-35189 is a resource exhaustion vulnerability in OpenSSL's X.509 certificate processing. A certificate containing many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches the parsed extensions. A certificate chain that fits under the ~100 KiB peer certificate limit can trigger allocation of several hundred MiB of resident memory during a standard TLS handshake. The flaw affects both TLS clients and servers that request client certificates. Multiple concurrent malicious handshakes can exhaust memory and crash the process, producing a denial of service condition. The issue is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
A single crafted certificate can force hundreds of megabytes of heap allocation per TLS handshake, enabling remote denial of service against OpenSSL-based clients and servers.

Affected Products

OpenSSL library — versions prior to the fixes in commits 2b93c73, 3842516, 8e0efc75, and c72ae182
TLS clients built against affected OpenSSL versions
TLS servers configured to solicit client certificates

Discovery Timeline

2026-09-29 - OpenSSL publishes Security Advisory 20260929
2026-09-29 - CVE-2026-35189 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-35189

Vulnerability Analysis

OpenSSL parses and caches X.509 extensions when a peer certificate is received. For CRL Distribution Point (CRLDP) extensions of type 1 (nameRelativeToCRLIssuer), the pre-patch implementation eagerly computed the full distinguished name for every distribution point by duplicating the issuer name with X509_NAME_dup(). A certificate can legitimately contain a large number of relative distribution points inside a compact DER encoding. The resulting many-to-one amplification allows a small on-wire certificate to expand into hundreds of megabytes of resident heap.

The fix defers this computation. The full name is now built on demand, only when CRL matching actually requires it, avoiding long-lived allocations tied to handshake state.

Root Cause

The root cause resides in setup_dp() in crypto/x509/v3_purp.c and DIST_POINT_set_dpname() in crypto/x509/v3_crld.c. Every parsed relative distribution point triggered an issuer name duplication cached on the DIST_POINT_NAME structure. There was no throttling on the number of distribution points processed at parse time, meeting the definition of unbounded resource allocation.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker connects to a vulnerable TLS server or induces a vulnerable client to connect to an attacker-controlled endpoint. The attacker presents a certificate containing many nameRelativeToCRLIssuer distribution points. During the handshake, the receiver caches the extensions and exhausts heap memory. Servers that request client certificates are exposed to unauthenticated remote attackers.

// Patch excerpt: crypto/x509/v3_purp.c
// Source: https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84

-/* Returns 1 on success, 0 if x is invalid, -1 on (internal) error. */
-static int setup_dp(const X509 *x, DIST_POINT *dp)
+/*
+ * The full name of a nameRelativeToCRLIssuer distribution point is not
+ * computed here.  Doing so for every parsed certificate cost an
+ * X509_NAME_dup() of the issuer name per relative distribution point,
+ * which a certificate with many such entries could turn into hundreds of
+ * megabytes of heap on a plain TLS handshake, while the result is only
+ * needed when a CRL is actually being matched against the certificate.
+ * That name is now built on demand in the CRL checking code instead.
+ */
+static int setup_dp(DIST_POINT *dp)
 {
-    const X509_NAME *iname = NULL;
-    int i;
-
     if (dp->distpoint == NULL && sk_GENERAL_NAME_num(dp->CRLissuer) <= 0) {
         ERR_raise(ERR_LIB_X509, X509_R_INVALID_DISTPOINT);
         return 0;

Detection Methods for CVE-2026-35189

Indicators of Compromise

Sudden, sharp increases in resident memory usage on TLS-terminating processes (web servers, proxies, application servers) coinciding with inbound TLS handshakes.
OOM killer events, malloc() failures, or process crashes correlated with a small number of TLS connections from a single peer.
Peer X.509 certificates containing an unusually large count of CRL distribution point entries with relative name fields.

Detection Strategies

Inspect captured TLS handshakes and parse peer certificates for the CRLDP extension; flag certificates with excessive nameRelativeToCRLIssuer entries.
Instrument OpenSSL-linked services with per-connection memory watermarks and alert on handshakes producing outsized allocations.
Correlate TLS handshake source addresses with process memory spikes in EDR or observability telemetry.

Monitoring Recommendations

Track RSS growth and heap allocation rates on openssl, nginx, httpd, haproxy, and application binaries linked to libssl.
Enable structured logging of TLS handshake failures and peer certificate metadata at ingress boundaries.
Alert on repeated TLS handshake attempts from a single source that terminate abnormally or coincide with resource pressure.

How to Mitigate CVE-2026-35189

Immediate Actions Required

Inventory all systems and containers linking against OpenSSL and identify services that accept TLS connections or request client certificates.
Upgrade OpenSSL to a patched release containing commits 2b93c73, 3842516, 8e0efc75, or c72ae182 as delivered by your distribution.
Rebuild and redeploy statically linked binaries and language runtimes that bundle their own OpenSSL copy.

Patch Information

The fix defers computation of relative CRLDP names until CRL processing time. Reference the upstream commits: OpenSSL commit 2b93c73, OpenSSL commit 3842516, OpenSSL commit 8e0efc75, and OpenSSL commit c72ae182. See the OpenSSL Security Advisory 20260929 for the complete list of fixed versions. The affected code is outside the FIPS module boundary; FIPS validation is not impacted.

Workarounds

Disable client certificate authentication on TLS servers where it is not required, removing the unauthenticated attack surface.
Apply strict per-process memory limits (cgroups, ulimit -v, systemd MemoryMax=) so that abusive handshakes fail contained rather than exhausting host memory.
Terminate TLS at a hardened reverse proxy or load balancer running a patched OpenSSL build in front of unpatched backends.

bash

# Example: constrain an OpenSSL-linked service with systemd
# /etc/systemd/system/myservice.service.d/limits.conf
[Service]
MemoryMax=512M
MemoryHigh=384M
TasksMax=256

# Verify installed OpenSSL version
openssl version -a

# Debian/Ubuntu: apply vendor updates
sudo apt update && sudo apt install --only-upgrade openssl libssl3

# RHEL/Rocky/Alma: apply vendor updates
sudo dnf update openssl openssl-libs