The vulnerability arises when OpenSSL processes an OCSP response with an empty sequence of responses during certificate verification. Because the cleanup code is bypassed, a structure allocated by OCSP_response_get1_basic is never freed, leading to a memory leak each time a TLS handshake with OCSP checking is performed. An attacker can cause the leaked memory to grow by including many bogus certificates in the response, allowing the attacker to control the amount leaked per handshake.

Affected systems are OpenSSL clients that have explicitly enabled OCSP response checking, such as those using the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL flags. No specific product versions are listed, so all builds using those flags that are not updated after the patch commits are potentially vulnerable.

The risk is a denial‑of‑service caused by progressive memory exhaustion in long‑running clients. Attackers can trigger the flaw by acting as a TLS server that sends a specially crafted OCSP response; no other privileged actions are required. With a CVSS score of 7.5, this vulnerability is considered high‑impact. The EPSS score is not available and the issue is not in the CISA KEV catalog, but the lack of a memory release is a serious flaw that can be exploited remotely with only network access to the client.