3.7
LowCVSS 3.1 · from VulnCheck
CVE-2026-118373
LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
LibreSSL · Cleartext transmission · CWE-319AffectedLibreSSL
FixA patch is linked in the references.
PublishedOct 28, 02:03 · VulnCheck
ScoredOct 28 · 3.7 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inLibreSSLup to 4.4.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known