6.3
Moyenne
CVE-2026-118372 LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by…
Description
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| LibreSSL 4.4 | premières → 4.4.0 | Pas de correctif indiqué |
Autres CVE de LibreSSL
Les 4 CVE de LibreSSL →
CVE-2026-118374
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to…
8.2
Élevée
CVE-2026-118373
LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
6.3
Moyenne
CVE-2026-118371
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and…
6.3
Moyenne