Low severity · published Oct 28, 2026
CVE-2026-118372
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
New
3.7
CVSS
–
EPSS
No
On KEV
Description
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreSSL · OpenBSD
through 4.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118372
patch
https://github.com/openbsd/src/commit/6efdc4cce3fac9fa7208a9452f84de34c5a68e9f
patch
https://github.com/openbsd/src/commit/3adb7688a5bcfb675fa6d8b10e242022d620a23d
technical-description
https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L344
technical-description
https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/ocspcheck.c#L154
release-notes
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
product
https://github.com/libressl/portable
More from LibreSSL
9.8
CVE-2023-35784
A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3
9.8
CVE-2021-46880
x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes…
9.8
CVE-2015-5334
Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a…
7.5
CVE-2015-5333
Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object…
7.4
CVE-2018-8970
The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length, which causes…