3.7
LowCVSS 3.1 · from VulnCheck
CVE-2026-118372
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
LibreSSL · CWE-93 · CWE-93AffectedLibreSSL
FixA patch is linked in the references.
PublishedOct 28, 02:03 · VulnCheck
ScoredOct 28 · 3.7 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inLibreSSLup to 4.4.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known