CVE-2026-54876 describes a memory leak vulnerability in OpenSSL affecting TLS clients that have enabled OCSP response checking. A malicious TLS server can send a BasicOCSPResponse with an empty SEQUENCE OF SingleResponse, causing the OCSP_BASICRESP structure to not be freed due to an early return bypassing cleanup code. The attacker can amplify the memory leak by padding bogus certificates into the response. Repeated connections to a malicious server can exhaust client memory over time, resulting in a Denial of Service. The vulnerability is classified under CWE-401 (Missing Release of Memory after Effective Lifetime). OCSP response checking is not enabled by default, so only clients explicitly using X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL flags are affected. FIPS modules in OpenSSL 4.0 and 3.6 are not impacted as the affected code lies outside the FIPS module boundary. Patches have been committed to the OpenSSL GitHub repository.