CVE-2026-118373
LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
OpenBSD LibreSSLOperating systems
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
Text from CVE List
Affected versions 1
- LibreSSLaffected: all versions through 4.4.0CVE List
References 5
- github.com/openbsd/src/commit/0f7039667044d1cd252cc72134e499186da4da25Fixvia CVE List
- vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-cleartext-transmission-of-ocsp-requests-via-url2hostAdvisoryvia CVE List
- github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L299Referencevia CVE List
- ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txtReferencevia CVE List
- github.com/libressl/portableReferencevia CVE List