Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118371— LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line

Quick assessment

Affected
OpenBSD LibreSSL
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LibreSSL 4.4.0 及更早版本在 库的 和 函数中存在 CRLF 注入漏洞。这些函数会将未经验证的请求路径写入 OCSP POST 请求行。攻击者可在证书的“授权信息访问”（Authority Information Access, AIA）OCSP URI 中嵌入回车符（CR）和换行符（LF），从而向 OCSP 响应服务器或代理注入 HTTP 头部，或拆分发送给它们的请求。

CVSS 3.7 · Low

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118371

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
Source: CVE Program / CVE List V5
Vulnerability Description
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenBSD LibreSSL 0 ~ 4.4.0 -

II. Public POCs for CVE-2026-118371

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118371

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118371 (2)

Vendor Pages for CVE-2026-118371 (3)

Same Patch Batch · OpenBSD · 2026-10-28 · 4 CVEs total

CVE-2026-118374 5.9 MEDIUM LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response
CVE-2026-118372 3.7 LOW LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
CVE-2026-118373 3.7 LOW LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()

IV. Related Vulnerabilities

Same product: LibreSSL
Same vendor: OpenBSD
Same weakness: CWE-93