Both of these vulnerabilities are problematic, though it’s some comfort that only one of them exists with the default OpenSSL configuration.

DoS attacks are problematic, though I’m wondering what creative uses attackers will find for buggy certificate chain verification.