5

CVE-2026-35188: openssl Double Free

CVSS: 5.0v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-35188DEBIAN-CVE-2026-35188CGA-4jcv-8vv4-f437
Published 09-06-2026Last modified 10-06-2026
Open JSON

Vulnerability summary

CVE-2026-35188 is a medium (CVSS 5.0) Double Free vulnerability in openssl. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.7% of scored vulnerabilities.

Overall risk
20/100
0100
Low · default modelHow is this calculated?
CVSS score
5.0/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.24%
0%100%
Low · -0.07 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 1
RHSA-2026:42825RHSA-2026:55543RHSA-2026:59635RHSA-2026:59641RHSA-2026:62562RHSA-2026:62563

Timeline

  1. 09-06-2026
    PublishedVulnerability first disclosed.
  2. 10-06-2026
    Last modifiedVulnerability information updated.

Description

Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution or other undefined behavior. If OCSP stapling is enabled and the TLS client connects to a malicious server, a crafted OCSP stapled response can trigger a double free in the TLS client when the stapled response is checked. The OCSP stapling is not enabled by default. Reliable code execution through a double-free is technically complex and highly environment-dependent but the Denial of Service impact is straightforward to achieve, warranting Moderate severity. No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

-0.07 pp

From 0.30% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard5 products
  • libcrypto3< 3.6.3-r0
  • libcrypto3-2.34< 3.6.3-r0
  • openssl< 3.6.3-r0
  • openssl-provider-fips-3.6.0All versions (No fix recorded)
  • openssl-provider-fips-3.6.0-dbgAll versions (No fix recorded)
Wolfi2 products
  • libcrypto3< 3.6.3-r0
  • openssl< 3.6.3-r0
Debian1 product
  • openssl< 3.6.3-1
Openssl1 product
  • openssl≥ 4.0.0, < 4.0.1 | ≥ 3.6.0, < 3.6.3 | 4.0.0
Ubuntu1 product
  • nodejsAll versions (No fix recorded)

5 vendors · 10 products

References

8 links