Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118372— LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

Quick assessment

Affected

OpenBSD LibreSSL

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LibreSSL 的工具（版本 4.4.0 及更早版本）存在 CRLF 注入漏洞。攻击者可通过在证书 AIA OCSP URI 路径中嵌入 CR/LF（回车/换行）序列，注入 HTTP 响应头。由于函数在复制路径时未过滤控制字符，且函数将该路径直接放入 POST 请求行中，攻击者能够向 OCSP 响应服务器注入自定义 HTTP 头，或拆分 OCSP 请求。

CVSS 3.7 · Low Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

Source: CVE Program / CVE List V5

Vulnerability Description

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对CRLF序列的转义处理不恰当(CRLF注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
OpenBSD	LibreSSL	0 ~ 4.4.0	-

II. Public POCs for CVE-2026-118372

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118372

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118372 (4)

Vendor Advisories for CVE-2026-118372 (1)

🔗 LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path | Advisories | VulnCheck third-party-advisory

Vendor Pages for CVE-2026-118372 (2)

https://www.cve.org/CVERecord?id=CVE-2026-118372

Same Patch Batch · OpenBSD · 2026-10-28 · 4 CVEs total

CVE-2026-118374	5.9 MEDIUM	LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response
CVE-2026-118371	3.7 LOW	LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
CVE-2026-118373	3.7 LOW	LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()

IV. Related Vulnerabilities

Same product: LibreSSL

Same vendor: OpenBSD

Same weakness: CWE-93