CVE-2026-118372 json
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
published 2026-10-28 12 d ago modified 2026-10-28 11 d ago also EUVD-2026-111548
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 3%
- public exploits
- 0
- none known
Summary
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Patch / fix
- github.com/openbsd/src@6efdc4c commit
- github.com/openbsd/src@3adb768 commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12 d ago
Exploit prediction
0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- OpenBSD LibreSSL
Classification
- Weakness
-
- CWE-93 Improper Neutralization of CRLF Sequences
References
-
github.com
/openbsd/src/commit/6efdc4cce3fac9fa7208a9452f84de34c5a68e9f
patch
-
github.com
/openbsd/src/commit/3adb7688a5bcfb675fa6d8b10e242022d620a23d
patch
-
github.com
/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L344
technical-description
-
github.com
/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/ocspcheck.c#L154
technical-description
-
ftp.openbsd.org
/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
release-notes
-
github.com
/libressl/portable
product
-
vulncheck.com
/advisories/libressl-ocspcheck-through-4.4.0-crlf-injection-via-aia-ocsp-url-path
third-party-advisory
Sources
- CVE List CVE-2026-118372
- NVD CVE-2026-118372
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.