{"id":"CVE-2026-118374","kind":"vulnerability","aliases":["CVE-2026-118374"],"related":[],"title":"LibreSSL ocspcheck: unbounded OCSP HTTP responses exhaust memory","description":"LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.","summary":"LibreSSL's ocspcheck tool, through version 4.4.0, reads HTTP headers and bodies from OCSP responders without a size limit. A malicious responder, or an attacker intercepting plain HTTP AIA OCSP traffic, can stream endless data and exhaust memory, which stops certificate status checks.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","libressl","ocspcheck","openbsd","tls"],"not_affected_if":["ocspcheck-not-installed"],"how_to_check":"- Check the installed LibreSSL version with `ocspcheck -V` or the package manager, if available, and compare against `4.4.0`.\n- Confirm whether ocspcheck is installed and used in a service: `which ocspcheck`.","fix":"- unknown: the sources do not name a fixed version or patch.","status":"open","published_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:26+00:00","updated_at":"2026-10-28T03:32:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T03:32:26Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version or patch.","reach":"network","title":"LibreSSL ocspcheck: unbounded OCSP HTTP responses exhaust memory","impact":"medium","summary":"LibreSSL's ocspcheck tool, through version 4.4.0, reads HTTP headers and bodies from OCSP responders without a size limit. A malicious responder, or an attacker intercepting plain HTTP AIA OCSP traffic, can stream endless data and exhaust memory, which stops certificate status checks.","category":"infrastructure","nicknames":[],"who_cares":["libressl","ocspcheck","openbsd","tls"],"confidence":0.6,"needs_auth":"no","worst_case":"Memory exhaustion denies certificate status checks on the host","analyst_note":"Confirm the fixed version and whether the flaw affects only the ocspcheck binary or the wider LibreSSL library, using the NVD entry and the upstream LibreSSL advisory.","how_to_check":"- Check the installed LibreSSL version with `ocspcheck -V` or the package manager, if available, and compare against `4.4.0`.\n- Confirm whether ocspcheck is installed and used in a service: `which ocspcheck`.","needs_analyst":true,"not_affected_if":["ocspcheck-not-installed"],"who_is_affected":"Systems that run LibreSSL's ocspcheck through version 4.4.0 to check certificate revocation status over HTTP. The sources do not say whether other LibreSSL components are affected. Teams that do not run ocspcheck, or that only use TLS libraries without this tool, can likely skip it, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000646,"input_tokens":3361,"output_tokens":620,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118374':11A,14A '-2026':10A,13A '4.4.0':26B,66C 'aia':48B,93C 'allow':73C 'attack':44B,85C 'bodi':31B,101C,109C 'certif':60B,112C 'check':62B,114C 'contain':67C 'control':86C 'cve':9A,12A 'data':54B,102C 'deni':111C 'endless':53B,98C 'exhaust':7A,56B,70C,78C 'head':105C 'header':29B,99C 'http':5A,28B,47B,83C,92C,104C,108C 'infrastructur':15B 'intercept':45B,90C 'libressl':1A,16B,20B,63C 'limit':38B 'malici':40B,74C 'memori':8A,57B,69C,79C 'ocsp':4A,33B,49B,75C,94C 'ocspcheck':2A,17B,22B,64C 'openbsd':18B 'plain':46B,91C 'read':27B,106C,110C 'respond':34B,41B,76C,88C 'respons':6A,84C 'send':81C 'size':37B 'status':61B,113C 'stop':59B 'stream':52B,97C 'tls':19B 'tool':23B 'traffic':50B,95C 'unbound':3A,82C 'version':25B 'vulner':71C 'without':35B","nicknames":[],"mitigations":[],"who_affected":"Systems that run LibreSSL's ocspcheck through version 4.4.0 to check certificate revocation status over HTTP. The sources do not say whether other LibreSSL components are affected. Teams that do not run ocspcheck, or that only use TLS libraries without this tool, can likely skip it, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118374","severity":null,"published_at":"2026-10-28T03:17:13+00:00","modified_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}