{"id":"CVE-2026-118372","kind":"vulnerability","aliases":["CVE-2026-118372"],"related":[],"title":"LibreSSL ocspcheck: CRLF in certificate OCSP URI injects HTTP headers","description":"LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.","summary":"LibreSSL's ocspcheck tool does not reject CR/LF characters in the path of a certificate's AIA OCSP URI, so the path is copied into the HTTP POST request line unchanged. An attacker who controls a certificate can inject extra HTTP headers or split the OCSP request sent to the responder host.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","libressl","ocspcheck","openbsd","self-hosted"],"not_affected_if":["ocspcheck-not-used","trusted-certificates-only"],"how_to_check":"- Run `ocspcheck -V` or `ocspcheck` with no arguments to see the installed LibreSSL version, and compare it with the fixed release in the sources (unknown)\n- Check whether ocspcheck is used on your systems at all, for example `which ocspcheck`","fix":"- Upgrade LibreSSL past `4.4.0` once a fixed release is published (fixed version unknown from the sources)\n- Until then, avoid running ocspcheck on untrusted certificates","status":"open","published_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:44+00:00","updated_at":"2026-10-28T03:32:44+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T03:32:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade LibreSSL past `4.4.0` once a fixed release is published (fixed version unknown from the sources)\n- Until then, avoid running ocspcheck on untrusted certificates","reach":"network","title":"LibreSSL ocspcheck: CRLF in certificate OCSP URI injects HTTP headers","impact":"low","summary":"LibreSSL's ocspcheck tool does not reject CR/LF characters in the path of a certificate's AIA OCSP URI, so the path is copied into the HTTP POST request line unchanged. An attacker who controls a certificate can inject extra HTTP headers or split the OCSP request sent to the responder host.","category":"infrastructure","nicknames":[],"who_cares":["libressl","ocspcheck","openbsd","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker injects HTTP headers or splits OCSP requests to the responder host.","analyst_note":"Confirm the fixed LibreSSL version and whether the library (not just the ocspcheck tool) is affected; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118372.","how_to_check":"- Run `ocspcheck -V` or `ocspcheck` with no arguments to see the installed LibreSSL version, and compare it with the fixed release in the sources (unknown)\n- Check whether ocspcheck is used on your systems at all, for example `which ocspcheck`","needs_analyst":true,"not_affected_if":["ocspcheck-not-used","trusted-certificates-only"],"who_is_affected":"Systems that run LibreSSL's ocspcheck utility through 4.4.0 on certificates that come from untrusted sources, since the attacker-controlled value is the OCSP URI inside the certificate. The sources do not describe whether applications linking the LibreSSL library are affected, so that is unknown. Teams that do not run ocspcheck can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":3362,"output_tokens":722,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118372':13A,16A '-2026':12A,15A '4.4.0':79C 'aia':40B,100C 'allow':86C 'attack':56B,87C,123C 'certif':5A,38B,60B,98C 'charact':32B,112C 'contain':80C 'control':58B,111C 'copi':47B,106C 'cr/lf':31B,94C 'crlf':3A,82C 'cve':11A,14A 'embed':93C 'extra':63B 'header':10A,65B,91C,126C 'host':23B,75B,135C 'http':9A,50B,64B,90C,114C 'infrastructur':17B 'inject':8A,62B,83C,89C,125C 'libressl':1A,18B,24B,76C 'line':53B,122C 'ocsp':6A,41B,69B,101C,129C 'ocspcheck':2A,19B,26B,77C 'open':115C 'openbsd':20B 'path':35B,45B,103C,108C 'place':116C 'post':51B,120C 'reject':30B,110C 'request':52B,70B,121C,130C 'respond':74B,134C 'self':22B 'self-host':21B 'sent':71B,131C 'sequenc':95C 'split':67B,128C 'tool':27B 'unchang':54B 'uri':7A,42B,102C 'url2host':105C 'vulner':84C 'without':109C","nicknames":[],"mitigations":[],"who_affected":"Systems that run LibreSSL's ocspcheck utility through 4.4.0 on certificates that come from untrusted sources, since the attacker-controlled value is the OCSP URI inside the certificate. The sources do not describe whether applications linking the LibreSSL library are affected, so that is unknown. Teams that do not run ocspcheck can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118372","severity":null,"published_at":"2026-10-28T03:17:13+00:00","modified_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}