Native memory leak on TLS client reading OCSP staple.

[rzikm]

Under specific condition, .NET 7 and 8 are leaking native memory during TLS handshake. The specific condition is:

• Server sends OCSP staple during TLS handshake (server running .NET 7+, or other stacks supporting OCSP)
• A client certificate is used and supplied via LocalCertificateSelectionCallback to SslStream:
  • This is the behavior for HttpClient configured with HttpClientHandler (the default handler)
  • Alternative ways do not have the problem (SslClientAuthenticationOptions.ClientCertificatesCollection or SslClientAuthenticationOptions.ClientCertificateContext)
• Server performs renegotiation (or post-handshake client authentication)

[ghost]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Under specific condition, .NET 7 and 8 are leaking native memory during TLS handshake. The specific condition is:

• Server sends OCSP staple during TLS handshake (server running .NET 7+, or other stacks supporting OCSP)
• A client certificate is used and supplied via LocalCertificateSelectionCallback to SslStream:
  • This is the behavior for HttpClient configured with HttpClientHandler (the default handler)
  • Alternative ways do not have the problem (SslClientAuthenticationOptions.ClientCertificatesCollection or SslClientAuthenticationOptions.ClientCertificateContext)
• Server performs renegotiation (or post-handshake client authentication)

Author:	rzikm
Assignees:	-
Labels:	area-System.Net.Security
Milestone:	-

[rzikm]

Fixed in main (9.0) in PR #96561 and in 8.0.2 in PR #96577 and in 7.0.16 in PR #96578 (February release).