6.3
Medium
CVE-2026-118373 LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
Description
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- Interaction
- None
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| LibreSSL 4.4 | earliest → 4.4.0 | No fix stated |
Other CVEs of LibreSSL
The 4 CVEs of LibreSSL →
CVE-2026-118374
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to…
8.2
High
CVE-2026-118372
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by…
6.3
Medium
CVE-2026-118371
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and…
6.3
Medium