LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

Advisories

LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

Severity: medium
Date: 10/27/2026
Affecting: LibreSSL <= 4.4.0
CVE: CVE-2026-118372
CWE: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSS: 6.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://github.com/openbsd/src/commit/6efdc4cce3fac9fa7208a9452f84de34c5a68e9f
https://github.com/openbsd/src/commit/3adb7688a5bcfb675fa6d8b10e242022d620a23d
https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L344
https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/ocspcheck.c#L154
LibreSSL 4.4.0 Release Notes
https://github.com/libressl/portable
Credit: Aziz Elbelaychy (Ostorlab), Kenjiro Nakayama
Description: LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo