6.3
Moyenne
CVE-2026-118371 LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and…
Description
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| LibreSSL 4.4 | premières → 4.4.0 | Pas de correctif indiqué |
Références
- github.com github.com
- github.com github.com
- LibreSSL 4.4.0 Release Notes ftp.openbsd.org
- github.com github.com
- VulnCheck Advisory: LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de LibreSSL
Les 4 CVE de LibreSSL →
CVE-2026-118374
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to…
8.2
Élevée
CVE-2026-118373
LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
6.3
Moyenne
CVE-2026-118372
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by…
6.3
Moyenne