CVE-2026-35189 describes a resource allocation vulnerability in OpenSSL where certificates containing many nameRelativeToCRLIssuer CRL distribution points cause excessive heap memory growth during caching of X.509 extensions. Although certificates remain under the accepted size limit (~100 KiB), the memory allocated can reach several hundred MiB, risking denial of service through memory exhaustion. The vulnerability affects TLS clients and servers that request client certificates. The remediation involves postponing CRL distribution point processing until required for CRL validation, preventing prolonged large memory allocations.

Receiving a crafted certificate from a malicious peer can cause significant memory consumption on the client or server side, potentially leading to crashes or denial of service. Multiple concurrent connections with such certificates amplify the risk. The vulnerability affects TLS handshake processes involving client certificate solicitation. There is no impact on FIPS modules, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves delaying processing of CRL distribution points until needed, which reduces memory usage. Until an official fix is available, monitoring for unusually large memory usage during TLS handshakes may help detect attempts to exploit this issue.