3.7
LowCVSS 3.1 · from VulnCheck
CVE-2026-118371
LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
LibreSSL · CWE-93 · CWE-93AffectedLibreSSL
FixA patch is linked in the references.
PublishedOct 28, 02:03 · VulnCheck
ScoredOct 28 · 3.7 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inLibreSSLup to 4.4.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known