Vulnerability in OpenBSD Libressl
CVE-2026-118372
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
Vulnerability class: CRLF Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.001 (3.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 3.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
Weakness classification (CWE)
References
- github.com/openbsd/src/commit/6efdc4cce3fac9fa7208a9452f84de34c5a68e9f (patch)
- github.com/openbsd/src/commit/3adb7688a5bcfb675fa6d8b10e242022d620a23d (patch)
- github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/o… (technical-description)
- github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/o… (technical-description)
- ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt (release-notes)
- github.com/libressl/portable (product)
- www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-crlf-injection-vi… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-118372?
- CVE-2026-118372 is a low-severity vulnerability in OpenBSD Libressl, classified under CRLF Injection. CVSS score: 3.7/10. Published 2026-10-28.
- How severe is CVE-2026-118372?
- Low severity. CVSS v3 base score is 3.7 out of 10.