AIKIDO-2026-240636
openssl is vulnerable to Memory Leak
37
Low Risk
This Affects:
opensslTL;DR
When OCSP response checking is enabled, a Basic OCSP response with an empty list of single responses returns early and skips freeing the OCSP_BASICRESP structure. A TLS server can repeat that response, and can pad it with extra certificates, so a long running client leaks memory on each handshake until it runs out of memory. The fix frees the response structure when the single response list is empty.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your TLS client enables OCSP response checking.
Background info
openssl is vulnerable to Memory Leak in versions 3.6.0 - 3.6.3 and 4.0.0 - 4.0.1.
How to fix this
Upgrade the openssl library to the patch version.
Links
GitHub Release
Fix Commits
github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.