CVE-2026-118373

LOW 3.7

LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.

CWE	CWE-319
Vendor	openbsd
Product	libressl
Published	Oct 28, 2026

Stay Ahead of the Next One

Get instant alerts for openbsd libressl

Be the first to know when new low vulnerabilities affecting openbsd libressl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

OpenBSD / LibreSSL

0 ≤ 4.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openbsd/src/commit/0f7039667044d1cd252cc72134e499186da4da25 github.com: https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L299 ftp.openbsd.org: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt github.com: https://github.com/libressl/portable vulncheck.com: https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-cleartext-transmission-of-ocsp-requests-via-url2host

Credits

Aziz Elbelaychy (Ostorlab) Kenjiro Nakayama