CVE-2026-54876

Name of the Vulnerable Software and Affected Versions OpenSSL (affected versions not specified)

Description A malicious TLS server can trigger a memory leak in a TLS client that has enabled OCSP response checking. This occurs when the server sends an OCSP response containing no single response entries. During X.509 certificate chain verification, if the X509 V FLAG OCSP RESP CHECK or X509 V FLAG OCSP RESP CHECK ALL flags are enabled, the OCSP BASICRESP structure allocated by the OCSP response get1 basic() function is not freed due to an early return that bypasses cleanup code. An attacker can amplify the amount of leaked memory per handshake by padding the certs field of the BasicOCSPResponse with bogus certificates. For long-running clients that repeatedly connect to a malicious server, this can lead to memory exhaustion and a Denial of Service. This issue only affects client applications that explicitly enable OCSP response check verification flags, as this feature is not enabled by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, avoid using the X509 V FLAG OCSP RESP CHECK and X509 V FLAG OCSP RESP CHECK ALL verification flags.