Is CVE-2026-35189 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35189 being exploited in the wild.

How severe is CVE-2026-35189?

Informational severity, published 29 September 2026.

Which products and versions are affected?

OpenSSL versions prior to fix commit 2b93c73 (September 2026).

Is there a fix for CVE-2026-35189?

A patch was published on 2026-09-29: Fix committed to OpenSSL repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35189 attacked?

It is attacked over the network or from the adjacent network.

Am I affected by CVE-2026-35189?

Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35189: OpenSSL heap growth in X.509 CRLDP processing

CVE-2026-35189 · Severity: info · Published 2026-09-29

OpenSSL experiences excessive memory consumption when processing crafted X.509 certificates containing many CRL distribution points with nameRelativeToCRLIssuer entries. A malicious peer can send a specially crafted certificate under 100 KB in size that causes the receiving system to allocate hundreds of megabytes of memory during TLS handshake, potentially crashing clients or servers.

Technologies: OpenSSL. Vendors: OpenSSL.

Quick answers

Is CVE-2026-35189 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35189 being exploited in the wild.
How severe is CVE-2026-35189?: Informational severity, published 29 September 2026.
Which products and versions are affected?: OpenSSL versions prior to fix commit 2b93c73 (September 2026).
Is there a fix for CVE-2026-35189?: A patch was published on 2026-09-29: Fix committed to OpenSSL repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35189 attacked?: It is attacked over the network or from the adjacent network.
Am I affected by CVE-2026-35189?: Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability (CWE-770) in OpenSSL's X.509 certificate extension caching allows certificates with multiple nameRelativeToCRLIssuer CRL distribution points to trigger disproportionate heap allocation. The vulnerability affects TLS peers accepting certificates and is exploited via normal handshake processing without requiring authentication or user interaction. The fix defers computation of relative CRLDP names until they are actually needed for CRL processing, avoiding prolonged memory allocations.

Affected products

OpenSSL OpenSSL versions prior to fix commit 2b93c73 (September 2026)

Timeline

2026-09-29: disclosed: CVE published
2026-09-29: patched: Fix committed to OpenSSL repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.