{"id":"CVE-2026-118371","kind":"vulnerability","aliases":["CVE-2026-118371"],"related":[],"title":"LibreSSL: OCSP request path lets certificate URIs inject HTTP headers","description":"LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.","summary":"LibreSSL through 4.4.0 does not validate the request path that libcrypto's OCSP_sendreq_new() and OCSP_parse_url() write into the OCSP POST request line. A certificate whose Authority Information Access OCSP URI contains carriage return and line feed characters can inject HTTP headers or split requests sent to OCSP responders and proxies.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","libressl","openbsd","self-hosted","tls"],"not_affected_if":["no-ocsp-fetch","openssl-only"],"how_to_check":"- Run `openssl version` or the LibreSSL build's version tool to confirm the library version; versions through `4.4.0` are listed as affected\n- Check whether your application or service fetches OCSP responses from certificate AIA URIs using LibreSSL libcrypto (unknown whether this is exposed in default configurations)","fix":"- Upgrade LibreSSL to a release later than `4.4.0` (fixed version unknown from the sources)\n- Until patched, avoid processing untrusted certificates that trigger OCSP fetches through LibreSSL","status":"open","published_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:45+00:00","updated_at":"2026-10-28T03:32:45+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T03:32:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade LibreSSL to a release later than `4.4.0` (fixed version unknown from the sources)\n- Until patched, avoid processing untrusted certificates that trigger OCSP fetches through LibreSSL","reach":"network","title":"LibreSSL: OCSP request path lets certificate URIs inject HTTP headers","impact":"low","summary":"LibreSSL through 4.4.0 does not validate the request path that libcrypto's OCSP_sendreq_new() and OCSP_parse_url() write into the OCSP POST request line. A certificate whose Authority Information Access OCSP URI contains carriage return and line feed characters can inject HTTP headers or split requests sent to OCSP responders and proxies.","category":"infrastructure","nicknames":[],"who_cares":["libressl","openbsd","self-hosted","tls"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker injects HTTP headers or splits requests sent to OCSP responders.","analyst_note":"Check the NVD entry and LibreSSL release notes for the fixed version and whether default builds perform OCSP fetches from certificate AIA URIs.","how_to_check":"- Run `openssl version` or the LibreSSL build's version tool to confirm the library version; versions through `4.4.0` are listed as affected\n- Check whether your application or service fetches OCSP responses from certificate AIA URIs using LibreSSL libcrypto (unknown whether this is exposed in default configurations)","needs_analyst":true,"not_affected_if":["openssl-only","no-ocsp-fetch"],"who_is_affected":"Systems that use LibreSSL libcrypto and perform OCSP checks against OCSP URIs taken from certificates, especially when certificates come from untrusted parties. The sources do not say which applications call OCSP_sendreq_new() or OCSP_parse_url() by default, so teams should check whether their TLS stack performs OCSP fetches at all.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":3370,"output_tokens":720,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118371':13A,16A '-2026':12A,15A '4.4.0':26B,80C 'access':55B,123C 'attack':108C 'author':53B,121C 'carriag':59B,111C 'certif':6A,51B,119C 'charact':64B,116C 'contain':58B,81C 'crlf':83C 'cve':11A,14A 'emb':110C 'feed':63B,115C 'function':96C 'header':10A,68B,129C 'host':22B 'http':9A,67B,128C 'inform':54B,122C 'infrastructur':17B 'inject':8A,66B,84C,127C 'let':5A 'libcrypto':34B,88C 'libressl':1A,18B,24B,78C 'line':49B,62B,107C,114C 'new':38B,91C 'ocsp':2A,36B,40B,46B,56B,74B,89C,93C,104C,124C 'openbsd':19B 'pars':41B,94C 'path':4A,32B,101C 'post':47B,105C 'proxi':77B,137C 'request':3A,31B,48B,71B,100C,106C,132C 'respond':75B,135C 'return':60B,112C 'self':21B 'self-host':20B 'sendreq':37B,90C 'sent':72B,133C 'split':70B,131C 'tls':23B 'unvalid':99C 'uri':7A,57B,125C 'url':42B,95C 'valid':29B 'vulner':85C 'whose':52B 'write':43B,98C","nicknames":[],"mitigations":[],"who_affected":"Systems that use LibreSSL libcrypto and perform OCSP checks against OCSP URIs taken from certificates, especially when certificates come from untrusted parties. The sources do not say which applications call OCSP_sendreq_new() or OCSP_parse_url() by default, so teams should check whether their TLS stack performs OCSP fetches at all.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118371","severity":null,"published_at":"2026-10-28T03:17:13+00:00","modified_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}