OpenSSL credits AISLE researchers on two OCSP flaws

OpenSSL's June advisory credits AISLE researchers on a moderate stapled-OCSP double free and a low-severity OCSP partial-chain NULL dereference.

Bug class: Double free and NULL pointer dereference
Affected codebase: OpenSSL OCSP and TLS client validation
Credited system: AISLE
Disclosed: June 9, 2026
Attribution: Self-reported attribution
AI role: Discovery
Severity: medium

Source status: OpenSSL's June 9 advisory credits AISLE researchers on both accepted CVEs, rates CVE-2026-35188 moderate and CVE-2026-42765 low, and preserves independent co-reporters on the first.

Summary

CVE-2026-35188 is a double free in a TLS client processing a crafted stapled OCSP response. CVE-2026-42765 is a NULL pointer dereference during OCSP chain checking with partial-chain verification.

The grouped severity follows OpenSSL: moderate for the first and low for the second, so the page is medium. The OpenSSL advisory retains the independent co-reporters on CVE-2026-35188; this entry does not turn shared credit into an AISLE-only claim.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.