CRLF Injection Vulnerability in LibreSSL's ocspcheck Tool
CVE-2026-118372

6.3MEDIUM

Key Information:

Vendor

OpenBSD
Status
Libressl
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118372?

The LibreSSL's ocspcheck tool up to version 4.4.0 is susceptible to a CRLF injection vulnerability, which enables attackers to manipulate HTTP headers by inserting CR (carriage return) and LF (line feed) sequences within the AIA OCSP URI path of a certificate. This occurs because the url2host() function improperly copies the URI path without filtering these control characters, allowing them to be included in the POST request line during execution. Exploiting this vulnerability can lead to the injection of malicious headers or the splitting of OCSP requests sent to the responder, potentially compromising the security of the system.

Affected Version(s)

LibreSSL 0 <= 4.4.0

References

https://github.com/openbsd/src/commit/6efdc4cce3fac9fa720...
patch
https://github.com/openbsd/src/commit/3adb7688a5bcfb675fa...
patch
https://github.com/openbsd/src/blob/17a8e44328ee2505d6972...
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aziz Elbelaychy (Ostorlab)
Kenjiro Nakayama
.