CVE-2026-118372
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Risk Assessment
HTTP header injection or request splitting may lead to manipulation of communication with the OCSP responder and potential response forgery. This poses a risk to the integrity of the certificate validation process.
Recommendation
Update LibreSSL to a non-vulnerable version that rejects control characters in URI paths. Validate certificate-derived input before using it in HTTP requests.
Other vulnerabilities in LibreSSL ocspcheck
See all- CVE-2026-118374Medium
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
- CVE-2026-118373Low
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
Original NVD description (English source)
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS