A use-after-free read occurs when multiple threads concurrently use the same X.509 certificate for the first time. OpenSSL caches decoded X.509v3 extension values in two phases: computation under a read lock and installation under a write lock. Since read locks do not exclude other readers, multiple threads may compute the cache simultaneously. A thread acquiring the write lock may free values installed by a previous thread that is still using pointers to that memory, leading to a process crash and Denial of Service. This issue specifically affects trusted CA certificates shared across connections in multi-threaded TLS clients or TLS servers that request client certificates.