Live › vulnerability › CVE-2026-118373
Go to dashboardLibreSSL's ocspcheck tool drops the https scheme from OCSP responder URLs and only uses TLS when the port is 443, so requests to https responders on other ports go out unencrypted. A network attacker on the path can read certificate serial numbers, issuer hashes and nonces from those requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Teams that run ocspcheck, or tooling built on it, to query OCSP responders over https on ports other than 443. Systems that only use ocspcheck against port 443 responders or never use it are not exposed by this flaw. The sources do not say which distributions package the tool.
No product ranges from the sources yet.
ocspcheck -V or check the installed LibreSSL version; affected versions are through 4.4.0.4.4.0 (fixed version unknown from sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
This page as .md · .json · in your agent: get_signal("CVE-2026-118373")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.