CVE-2026-118372
Low
Description
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
SeverityLow
CVSS3.7
Exploit probability—
ProductLibreSSL
PublishedOct 28, 2026
First seenOct 28, 2026
Weakness typeCWE-93CWE-93
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenBSD LibreSSL | v ≤ 4.4.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.