CVE-2026-118371

LOW 3.7

LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.

CWE	CWE-93
Vendor	openbsd
Product	libressl
Published	Oct 28, 2026

Stay Ahead of the Next One

Get instant alerts for openbsd libressl

Be the first to know when new low vulnerabilities affecting openbsd libressl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

OpenBSD / LibreSSL

0 ≤ 4.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openbsd/src/commit/d3f7195f4849d8a699cea4a3a67677f4b3dc1591 github.com: https://github.com/openbsd/src/blob/3903c41d301d66facec69f7bf776b182cbc5ed62/lib/libcrypto/ocsp/ocsp_ht.c#L184 ftp.openbsd.org: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt github.com: https://github.com/libressl/portable vulncheck.com: https://www.vulncheck.com/advisories/libressl-through-4.4.0-crlf-injection-via-ocsp-sendreq-new-request-line

Credits

Aziz Elbelaychy (Ostorlab) Theo Buehler