Cleartext Transmission Vulnerability in LibreSSL OCSPCheck by OpenBSD
CVE-2026-118373

6.3MEDIUM

Key Information:

Vendor

OpenBSD
Status
Libressl
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118373?

The LibreSSL ocspcheck tool, up to version 4.4.0, exhibits a vulnerability that allows on-path network attackers to intercept and read OCSP requests sent to HTTPS responders on ports other than 443. This issue arises due to url2host() discarding the OCSP URL scheme, resulting in a failure to enforce secure communication for OCSP requests. Consequently, sensitive data such as certificate serial numbers, issuer hashes, and nonces may be exposed to malicious entities, heightening the risk of man-in-the-middle attacks.

Affected Version(s)

LibreSSL 0 <= 4.4.0

References

https://github.com/openbsd/src/commit/0f7039667044d1cd252...
patch
https://github.com/openbsd/src/blob/17a8e44328ee2505d6972...
technical-description
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4...
release-notes

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aziz Elbelaychy (Ostorlab)
Kenjiro Nakayama
.