{"id":"CVE-2026-118373","kind":"vulnerability","aliases":["CVE-2026-118373"],"related":[],"title":"LibreSSL ocspcheck sends OCSP requests in cleartext on non-443 ports","description":"LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.","summary":"LibreSSL's ocspcheck tool drops the https scheme from OCSP responder URLs and only uses TLS when the port is 443, so requests to https responders on other ports go out unencrypted. A network attacker on the path can read certificate serial numbers, issuer hashes and nonces from those requests.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","libressl","ocspcheck","self-hosted","tls"],"not_affected_if":["default-config","port-443-only"],"how_to_check":"- Run `ocspcheck -V` or check the installed LibreSSL version; affected versions are through `4.4.0`.\n- Look for scripts or configs that call ocspcheck against OCSP responder URLs using https on a port other than 443.","fix":"- Upgrade LibreSSL ocspcheck to a release newer than `4.4.0` (fixed version unknown from sources).\n- Until patched, avoid ocspcheck for https responders on non-443 ports.","status":"open","published_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:43+00:00","updated_at":"2026-10-28T03:32:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T03:32:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade LibreSSL ocspcheck to a release newer than `4.4.0` (fixed version unknown from sources).\n- Until patched, avoid ocspcheck for https responders on non-443 ports.","reach":"network","title":"LibreSSL ocspcheck sends OCSP requests in cleartext on non-443 ports","impact":"low","summary":"LibreSSL's ocspcheck tool drops the https scheme from OCSP responder URLs and only uses TLS when the port is 443, so requests to https responders on other ports go out unencrypted. A network attacker on the path can read certificate serial numbers, issuer hashes and nonces from those requests.","category":"infrastructure","nicknames":[],"who_cares":["libressl","ocspcheck","tls","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"on-path attacker reads OCSP request contents including serial numbers","analyst_note":"Confirm the fixed ocspcheck version and whether downstream distributions ship the patch; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118373.","how_to_check":"- Run `ocspcheck -V` or check the installed LibreSSL version; affected versions are through `4.4.0`.\n- Look for scripts or configs that call ocspcheck against OCSP responder URLs using https on a port other than 443.","needs_analyst":true,"not_affected_if":["default-config","port-443-only"],"who_is_affected":"Teams that run ocspcheck, or tooling built on it, to query OCSP responders over https on ports other than 443. Systems that only use ocspcheck against port 443 responders or never use it are not exposed by this flaw. The sources do not say which distributions package the tool.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":3350,"output_tokens":647,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118373':14A,17A '-2026':13A,16A '-443':10A,116C '4.4.0':78C '443':45B,99C 'alloc':93C 'attack':59B,104C 'certif':65B,119C 'cleartext':7A,81C 'contain':79C 'cve':12A,15A 'discard':86C 'drop':29B 'expos':118C 'go':54B 'hash':69B,123C 'host':23B 'http':92C 'https':31B,49B,111C 'infrastructur':18B 'issuer':68B,122C 'libressl':1A,19B,25B,75C 'network':58B,103C 'non':9A,115C 'nonc':71B,125C 'number':67B,121C 'ocsp':4A,34B,88C,107C 'ocspcheck':2A,20B,27B,76C 'on-path':100C 'path':62B,102C 'port':11A,43B,53B,98C,117C 'read':64B,106C 'request':5A,47B,74B,108C 'respond':35B,50B,112C 'scheme':32B,90C 'select':95C 'self':22B 'self-host':21B 'send':3A 'sent':109C 'serial':66B,120C 'tls':24B,40B,96C 'tool':28B 'transmiss':82C 'unencrypt':56B 'url':36B,89C,113C 'url2host':85C 'use':39B 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Teams that run ocspcheck, or tooling built on it, to query OCSP responders over https on ports other than 443. Systems that only use ocspcheck against port 443 responders or never use it are not exposed by this flaw. The sources do not say which distributions package the tool.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118373","severity":null,"published_at":"2026-10-28T03:17:13+00:00","modified_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}