CVE Feed

    Dashboard / CVE / CVE-2026-118371

    CVE-2026-118371

    LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.

    Published:Oct 28, 2026
    Last Modified:Oct 28, 2026
    EPS:Oct 28, 2026
    EPSS Score:
    CVSS Score:3.7

    Affected Products

    Vendor
    Openbsd
    Product
    Libressl

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-15 Command Delimiters
    CAPEC-81 Web Server Logs Tampering

    Related CVEs

    CVE-2026-118374 (CVSS 8.2) — LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP respond…
    CVE-2026-118373 (CVSS 6.3) — LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards t…
    CVE-2026-118372 (CVSS 6.3) — LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP …
    CVE-2023-35784 (CVSS 9.8) — A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before er…
    CVE-2021-46880 (CVSS 9.8) — x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass b…
    CVE-2022-48437 (CVSS 5.3) — An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. …
    CVE-2021-41581 (CVSS 5.5) — x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-…
    CVE-2019-25049 (CVSS 7.1) — LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print…
    CVE-2019-25048 (CVSS 7.1) — LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx…
    CVE-2015-5333 (CVSS 7.5) — Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High