Medium severity · published Oct 28, 2026
CVE-2026-118374
LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response
New
5.9
CVSS
–
EPSS
No
On KEV
Description
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LibreSSL · OpenBSD
through 4.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118374
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118374
patch
https://github.com/openbsd/src/commit/bf5da63f53179ef423d18c56d6da89eaefb56228
patch
https://github.com/openbsd/src/commit/de4274c56c9ace88232591d4c919d79281a8de59
technical-description
https://github.com/openbsd/src/blob/f6f428241d469cf434e60b73fc834d0448f068d5/usr.sbin/ocspcheck/http.c#L419
release-notes
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
product
https://github.com/libressl/portable
third-party-advisory
https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-memory-exhaustion-via-unbounded-ocsp-http-response
More from LibreSSL
9.8
CVE-2023-35784
A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3
9.8
CVE-2021-46880
x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes…
9.8
CVE-2015-5334
Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a…
7.5
CVE-2015-5333
Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object…
7.4
CVE-2018-8970
The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length, which causes…