Live › vulnerability › CVE-2026-118374
Go to dashboardLibreSSL's ocspcheck tool, through version 4.4.0, reads HTTP headers and bodies from OCSP responders without a size limit. A malicious responder, or an attacker intercepting plain HTTP AIA OCSP traffic, can stream endless data and exhaust memory, which stops certificate status checks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Systems that run LibreSSL's ocspcheck through version 4.4.0 to check certificate revocation status over HTTP. The sources do not say whether other LibreSSL components are affected. Teams that do not run ocspcheck, or that only use TLS libraries without this tool, can likely skip it, but the sources do not confirm this.
No product ranges from the sources yet.
ocspcheck -V or the package manager, if available, and compare against 4.4.0.which ocspcheck.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
This page as .md · .json · in your agent: get_signal("CVE-2026-118374")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.