Live › vulnerability › CVE-2026-118371
Go to dashboardLibreSSL through 4.4.0 does not validate the request path that libcrypto's OCSP_sendreq_new() and OCSP_parse_url() write into the OCSP POST request line. A certificate whose Authority Information Access OCSP URI contains carriage return and line feed characters can inject HTTP headers or split requests sent to OCSP responders and proxies.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Systems that use LibreSSL libcrypto and perform OCSP checks against OCSP URIs taken from certificates, especially when certificates come from untrusted parties. The sources do not say which applications call OCSP_sendreq_new() or OCSP_parse_url() by default, so teams should check whether their TLS stack performs OCSP fetches at all.
No product ranges from the sources yet.
openssl version or the LibreSSL build's version tool to confirm the library version; versions through 4.4.0 are listed as affected4.4.0 (fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
This page as .md · .json · in your agent: get_signal("CVE-2026-118371")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.