---
id: "CVE-2026-118373"
kind: "vulnerability"
aliases: ["CVE-2026-118373"]
title: "LibreSSL ocspcheck sends OCSP requests in cleartext on non-443 ports"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "libressl", "ocspcheck", "self-hosted", "tls"]
not_affected_if: ["default-config", "port-443-only"]
published_at: "2026-10-28T03:17:13+00:00"
first_seen_at: "2026-10-28T03:31:02+00:00"
updated_at: "2026-10-28T03:32:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118373", "first_seen_at": "2026-10-28T03:31:02+00:00"}]
---

# LibreSSL ocspcheck sends OCSP requests in cleartext on non-443 ports

LibreSSL's ocspcheck tool drops the https scheme from OCSP responder URLs and only uses TLS when the port is 443, so requests to https responders on other ports go out unencrypted. A network attacker on the path can read certificate serial numbers, issuer hashes and nonces from those requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `ocspcheck -V` or check the installed LibreSSL version; affected versions are through `4.4.0`.
- Look for scripts or configs that call ocspcheck against OCSP responder URLs using https on a port other than 443.

## Fix

- Upgrade LibreSSL ocspcheck to a release newer than `4.4.0` (fixed version unknown from sources).
- Until patched, avoid ocspcheck for https responders on non-443 ports.

## Timeline

- 2026-10-28T03:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118373

## From the sources

LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_