CVE-2026-118373
Low
Description
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
SeverityLow
CVSS3.7
Exploit probability—
ProductLibreSSL
PublishedOct 28, 2026
First seenOct 28, 2026
Weakness typeCWE-319CWE-319
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenBSD LibreSSL | v ≤ 4.4.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.