Vulnerability in OpenBSD Libressl
CVE-2026-118371
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
Vulnerability class: CRLF Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.001 (3.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 3.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
Weakness classification (CWE)
References
- github.com/openbsd/src/commit/d3f7195f4849d8a699cea4a3a67677f4b3dc1591 (patch)
- github.com/openbsd/src/blob/3903c41d301d66facec69f7bf776b182cbc5ed62/lib/libcry… (technical-description)
- ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt (release-notes)
- github.com/libressl/portable (product)
- www.vulncheck.com/advisories/libressl-through-4.4.0-crlf-injection-via-ocsp-sen… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-118371?
- CVE-2026-118371 is a low-severity vulnerability in OpenBSD Libressl, classified under CRLF Injection. CVSS score: 3.7/10. Published 2026-10-28.
- How severe is CVE-2026-118371?
- Low severity. CVSS v3 base score is 3.7 out of 10.