---
id: "CVE-2026-118374"
kind: "vulnerability"
aliases: ["CVE-2026-118374"]
title: "LibreSSL ocspcheck: unbounded OCSP HTTP responses exhaust memory"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "libressl", "ocspcheck", "openbsd", "tls"]
not_affected_if: ["ocspcheck-not-installed"]
published_at: "2026-10-28T03:17:13+00:00"
first_seen_at: "2026-10-28T03:31:02+00:00"
updated_at: "2026-10-28T03:32:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118374", "first_seen_at": "2026-10-28T03:31:02+00:00"}]
---

# LibreSSL ocspcheck: unbounded OCSP HTTP responses exhaust memory

LibreSSL's ocspcheck tool, through version 4.4.0, reads HTTP headers and bodies from OCSP responders without a size limit. A malicious responder, or an attacker intercepting plain HTTP AIA OCSP traffic, can stream endless data and exhaust memory, which stops certificate status checks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LibreSSL version with `ocspcheck -V` or the package manager, if available, and compare against `4.4.0`.
- Confirm whether ocspcheck is installed and used in a service: `which ocspcheck`.

## Fix

- unknown: the sources do not name a fixed version or patch.

## Timeline

- 2026-10-28T03:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118374

## From the sources

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_