---
id: "CVE-2026-118372"
kind: "vulnerability"
aliases: ["CVE-2026-118372"]
title: "LibreSSL ocspcheck: CRLF in certificate OCSP URI injects HTTP headers"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "libressl", "ocspcheck", "openbsd", "self-hosted"]
not_affected_if: ["ocspcheck-not-used", "trusted-certificates-only"]
published_at: "2026-10-28T03:17:13+00:00"
first_seen_at: "2026-10-28T03:31:02+00:00"
updated_at: "2026-10-28T03:32:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118372", "first_seen_at": "2026-10-28T03:31:02+00:00"}]
---

# LibreSSL ocspcheck: CRLF in certificate OCSP URI injects HTTP headers

LibreSSL's ocspcheck tool does not reject CR/LF characters in the path of a certificate's AIA OCSP URI, so the path is copied into the HTTP POST request line unchanged. An attacker who controls a certificate can inject extra HTTP headers or split the OCSP request sent to the responder host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `ocspcheck -V` or `ocspcheck` with no arguments to see the installed LibreSSL version, and compare it with the fixed release in the sources (unknown)
- Check whether ocspcheck is used on your systems at all, for example `which ocspcheck`

## Fix

- Upgrade LibreSSL past `4.4.0` once a fixed release is published (fixed version unknown from the sources)
- Until then, avoid running ocspcheck on untrusted certificates

## Timeline

- 2026-10-28T03:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118372

## From the sources

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_