CVE catalog

CVE-2026-35188

Severity: Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Jun 9, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.30% · Oct 25, 2026

Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution or other undefined behavior. If OCSP stapling is enabled and the TLS client connects to a malicious server, a crafted OCSP stapled response can trigger a double free in the TLS client when the stapled response is checked. The OCSP stapling is not enabled by default. Reliable code execution through a double-free is technically complex and highly environment-dependent but the Denial of Service impact is straightforward to achieve, warranting Moderate severity. No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openssl	sid	`3.6.5-1`	fixed
Debian	openssl	forky	`3.6.5-1`	fixed
Debian	openssl	trixie	`3.5.7-1~deb13u2`	not affected
Debian	openssl	trixie-security	`3.5.7-1~deb13u3`	not affected
Debian	openssl	bookworm	`3.0.20-1~deb12u2`	not affected
Debian	openssl	bookworm-security	`3.0.22-1~deb12u2`	not affected
Cpe	openssl	Not reported	`3.6.3`	fixed
Cpe	openssl	Not reported	Not reported	unknown
Cpe	openssl	Not reported	Not reported	not affected
Ubuntu	nodejs	pro	`12.22.5~dfsg-5ubuntu1`	vulnerable
Ubuntu	nodejs	pro	`12.22.7~dfsg-2ubuntu1`	vulnerable
Ubuntu	nodejs	pro	`12.22.7~dfsg-2ubuntu3`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu2`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.1`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.2`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.3`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.4`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.5`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.6`	vulnerable
Ubuntu	nodejs	pro	`12.22.9~dfsg-1ubuntu3.6+esm2`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openssl	source	sid	`3.6.3-1`	not yet assigned	Not reported	[1139674]
Debian	openssl	source	forky	`3.6.3-1`	not yet assigned	Not reported	[1139674]
Debian	openssl	source	trixie	`Not affected`	unimportant	Not reported	[1139674]
Debian	openssl	source	bookworm	`Not affected`	unimportant	Not reported	[1139674]
Cpe	openssl	cpe	Not reported	`3.6.3`	Not reported	Not reported	Not reported

[Debian bug #1139674]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libssl3]Not affected
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
[libssl-dev]Not affected
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
[libssl-doc]Not affected
Source package: [openssl]
Details (6)
- 3.0.20-1~deb12u2 · all · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · all · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · all · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · all · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · all · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
[openssl]Not affected
Details (6)
- 3.0.20-1~deb12u2 · amd64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · amd64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.20-1~deb12u2 · arm64 · bookworm-security
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · amd64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm
- 3.0.17-1~deb12u2 · arm64 · bookworm-updates
  Not affected
  nvd · openssl · debian · bookworm

Observed: Oct 27, 2026, 7:15:11 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]