Remote Code Execution in OpenSSL OCSP Stapling (CVE‑2026‑35188) Threatens TLS Deployments
What It Is — OpenSSL 1.1.1 and later contain a double‑free flaw in the processing of malformed OCSP stapling responses. An attacker who can cause a client to request a crafted OCSP response can trigger remote code execution (RCE) in the context of the vulnerable process.
Exploitability — Remote exploitation is possible; user interaction is limited to the client making a TLS request to a malicious server. CVSS v3.1 7.5 (High) – AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. A proof‑of‑concept has been disclosed to the vendor, and an official patch is available.
Affected Products — OpenSSL library (all versions impacted by the OCSP stapling verification routine).
Why It Matters for Compliance & Audit Readiness
- Continuous control monitoring must capture library version drift; an unpatched OpenSSL component represents a control gap in the “Cryptographic Key Management” and “System Hardening” domains of SOC 2.
- Demonstrating timely remediation (patch management) is a core audit evidence point; the vulnerability underscores the need for automated evidence collection to prove due diligence.
- Enterprise buyers increasingly require proof that TLS‑terminating services are patched against high‑severity flaws before signing contracts.
Recommended Actions
- Identify all assets running vulnerable OpenSSL versions via an inventory scan.
- Apply the vendor‑released patch immediately and verify the fix.
- Update your SOC 2 control mappings to include OpenSSL version checks as part of the “System Operations” control set.
- Enable continuous monitoring (e.g., automated vulnerability scanning) to capture future library updates as audit evidence.