6.3
Medium
CVE-2026-118372 LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by…
Description
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| LibreSSL 4.4 | earliest → 4.4.0 | No fix stated |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- LibreSSL 4.4.0 Release Notes ftp.openbsd.org
- github.com github.com
- VulnCheck Advisory: LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of LibreSSL
The 4 CVEs of LibreSSL →
CVE-2026-118374
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to…
8.2
High
CVE-2026-118373
LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
6.3
Medium
CVE-2026-118371
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and…
6.3
Medium