CVE-2026-54876 describes a memory leak vulnerability in TLS clients that have enabled OCSP response checking via the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL flags. When a malicious TLS server sends an OCSP BasicOCSPResponse containing an empty SEQUENCE OF SingleResponse entries, the allocated OCSP_BASICRESP structure is not freed due to an early return in the verification function, bypassing cleanup code. Attackers can increase the leaked memory by padding the BasicOCSPResponse with bogus certificates, which are parsed and stored before the empty response triggers the early return. This leak can accumulate over multiple handshakes, potentially exhausting client memory and causing a denial of service. The vulnerability does not affect clients that do not enable OCSP response checking and does not impact OpenSSL FIPS modules 3.6 and 4.0.

An attacker controlling a malicious TLS server can cause a TLS client that has enabled OCSP response checking to leak an attacker-controlled amount of memory per TLS handshake. Over time, repeated connections to such a server can exhaust the client's memory resources, leading to a denial of service condition. This impact is limited to clients that explicitly enable OCSP response checking and does not affect default client configurations or FIPS module usage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, clients should consider disabling OCSP response checking if feasible or limit connections to untrusted servers. Since OCSP response checking is not enabled by default, avoiding enabling these flags reduces exposure. Monitor vendor advisories for updates and apply official patches once released.