TI-2026-27343 Aliases CVE-2026-35189 GHSA-3r46-fh9h-qv77

Excessive Memory Allocation in Relative CRLDP Processing

LOW 30CWE-770Published 2026-09-29 · Updated 2026-09-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 1 fixed, 11 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module boundary.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00317 24th percentileScored 2026-11-07

Fix Partial OpenSSL (OpenSSL): 4.0.3, 3.6.5, 3.5.9 +4Red Hat: 2 advisoriesRed Hat: 1 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenSSL	OpenSSL	4.0.0 to before 4.0.3; 3.6.0 to before 3.6.5; 3.5.0 to before 3.5.9; 3.4.0 to before 3.4.8; 3.0.0 to before 3.0.23; 1.1.1 to before 1.1.1zj; 1.0.2 to before 1.0.2zs	4.0.3, 3.6.5, 3.5.9, 3.4.8, 3.0.23, 1.1.1zj, 1.0.2zs	Patch available	CNA

OpenSSL VendorOpenSSL Affected 4.0.0 to before 4.0.3; 3.6.0 to before 3.6.5; 3.5.0 to before 3.5.9; 3.4.0 to before 3.4.8; 3.0.0 to before 3.0.23; 1.1.1 to before 1.1.1zj; 1.0.2 to before 1.0.2zs Fixed in 4.0.3, 3.6.5, 3.5.9, 3.4.8, 3.0.23, 1.1.1zj, 1.0.2zs Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openssl:openssl::::::::	1.0.2 to before 1.0.2zs; 1.1.1 to before 1.1.1zj; 3.0.0 to before 3.0.23; 3.4.0 to before 3.4.8; 3.5.0 to before 3.5.9; 3.6.0 to before 3.6.5; 4.0.0 to before 4.0.3	Vulnerable	OpenSSL

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.0.2 to before 1.0.2zs; 1.1.1 to before 1.1.1zj; 3.0.0 to before 3.0.23; 3.4.0 to before 3.4.8; 3.5.0 to before 3.5.9; 3.6.0 to before 3.6.5; 4.0.0 to before 4.0.3 Vulnerable ·OpenSSL

Remediation

Fix · CNA OpenSSL (OpenSSL) Fixed in 4.0.3, 3.6.5, 3.5.9, 3.4.8, 3.0.23, 1.1.1zj, 1.0.2zs

Red Hat 2 advisories

RHSA-2026:74166 Released 2026-09-30 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images openssl3-1:3.5.9-0.1.hum1@src, openssl3-devel-1:3.5.9-0.1.hum1@aarch64, openssl3-devel-1:3.5.9-0.1.hum1@x86_64 +4
RHSA-2026:74162 Released 2026-09-30 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images openssl-1:3.5.9-0.1.hum1@aarch64, openssl-1:3.5.9-0.1.hum1@src, openssl-1:3.5.9-0.1.hum1@x86_64 +12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-09-29
OpenSSL — openssl-library.org/news/secadv/20260929.txt
14 records Highest priority Priority MEDIUM 3 MEDIUM, 11 LOW
Other records, highest priority first
- TI-2026-58283 DTLS Retransmits Handshake Messages From a Stale Buffer OffsetPriority MEDIUM 43
- TI-2026-58285 QUIC: Unbounded RETIRE_CONNECTION_ID BacklogPriority MEDIUM 40
- TI-2026-39654 QUIC STREAM Fragment Metadata DoSPriority MEDIUM 40
Show all 14 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Developer Hub 1	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet
Red Hat JBoss Core Services	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	—
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 5	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:74162, RHSA-2026:74166

Not affected: 2 products

Red Hat Hardened Images
Red Hat OpenShift AI (RHOAI)

Timeline

2026-10-02 Threatist record created from CVE-2026-35189
2026-10-03 Alias added: GHSA-3r46-fh9h-qv77
2026-10-27 Affected versions changed · Red Hat
2026-10-30 Affected versions changed · Red Hat
2026-11-06 Affected versions changed · Red Hat

References

Patch 4

Advisory 1

OpenSSL Advisory

TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8

See all 312 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences