Memory Exhaustion Vulnerability in LibreSSL OCSP Check Feature
CVE-2026-118374

8.2HIGH

Key Information:

Vendor

OpenBSD
Status
Libressl
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118374?

LibreSSL's OCSP check feature prior to version 4.4.0 is vulnerable to a memory exhaustion issue. This vulnerability arises when malicious OCSP responders exploit the system by sending unbounded HTTP responses. Such attackers can stream continuous headers or body data to the functions http_head_read() and http_body_read(). This leads to the potential denial of service, preventing proper certificate status checks and compromising the integrity of secure connections.

Affected Version(s)

LibreSSL 0 <= 4.4.0

References

https://github.com/openbsd/src/commit/bf5da63f53179ef423d...
patch
https://github.com/openbsd/src/commit/de4274c56c9ace88232...
patch
https://github.com/openbsd/src/blob/f6f428241d469cf434e60...
technical-description

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aziz Elbelaychy (Ostorlab)
Frank Denis
.