CVE-2026-118372
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
OpenBSD LibreSSLOperating systems
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Text from CVE List
Affected versions 1
- LibreSSLaffected: all versions through 4.4.0CVE List
References 7
- github.com/openbsd/src/commit/6efdc4cce3fac9fa7208a9452f84de34c5a68e9fFixvia CVE List
- github.com/openbsd/src/commit/3adb7688a5bcfb675fa6d8b10e242022d620a23dFixvia CVE List
- vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-crlf-injection-via-aia-ocsp-url-pathAdvisoryvia CVE List
- github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L344Referencevia CVE List
- github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/ocspcheck.c#L154Referencevia CVE List
- ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txtReferencevia CVE List
- github.com/libressl/portableReferencevia CVE List