The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions.
Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations.
The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received.
FIPS impact: no The affected code is outside the FIPS module boundary.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openssl | Oct 1, 2026 | Sep 29, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssl-snapsafe-staticUpgrade openssl-snapsafe-develUpgrade openssl11-libsUpgrade openssl-snapsafe-perlUpgrade openssl11Upgrade openssl11-develUpgrade openssl-snapsafe-debuginfoUpgrade openssl-staticUpgrade opensslUpgrade openssl11-debuginfoUpgrade openssl-snapsafeUpgrade openssl11-staticUpgrade openssl-perlUpgrade openssl-debuginfoUpgrade openssl-libsUpgrade openssl-develUpgrade openssl-snapsafe-libs | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade openssl-debugsourceUpgrade openssl-fips-provider-latestUpgrade openssl-develUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-libsUpgrade openssl-perlUpgrade openssl-fips-provider-latest-debuginfoUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-libs-debuginfoUpgrade openssl-snapsafe-libs | Oct 13, 2026 | Sep 29, 2026 |
| Debian | — | Upgrade openssl | Oct 1, 2026 | Sep 29, 2026 |
| Freebsd | — | Upgrade openssl34Upgrade openssl30Upgrade openssl36Upgrade openssl40Upgrade FreeBSDUpgrade openssl | Oct 5, 2026 | Sep 30, 2026 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Sep 30, 2026 | Sep 29, 2026 |
| Redhat_linux | — | No solution exists | Oct 1, 2026 | Sep 29, 2026 |
| Ubuntu | — | Upgrade libssl3t64Upgrade openssl1.0 (Ubuntu Pro)Upgrade openssl (Ubuntu Pro)Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade libssl1.1 (Ubuntu Pro)Upgrade libssl3 | Oct 6, 2026 | Sep 29, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub