{"id":"CVE-2026-118371","title":"LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line","summary":"LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-93"],"vendor":"OpenBSD","product":"LibreSSL","affected":["LibreSSL <= 4.4.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T12:41:12.233917Z"},"published":"2026-10-28","updated":"2026-11-03","sourceUpdated":"2026-11-03T12:41:48.334Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118371","references":[{"url":"https://github.com/openbsd/src/commit/d3f7195f4849d8a699cea4a3a67677f4b3dc1591"},{"url":"https://github.com/openbsd/src/blob/3903c41d301d66facec69f7bf776b182cbc5ed62/lib/libcrypto/ocsp/ocsp_ht.c#L184"},{"url":"https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt","label":"LibreSSL 4.4.0 Release Notes"},{"url":"https://github.com/libressl/portable"},{"url":"https://www.vulncheck.com/advisories/libressl-through-4.4.0-crlf-injection-via-ocsp-sendreq-new-request-line","label":"VulnCheck Advisory: LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line"}],"tags":["cve.org"],"epss":0.00135,"epssPercentile":0.03012,"ingestedAt":"2026-10-28T03:02:57.626Z","slug":"CVE-2026-118371","body":"## Overview\n\nLibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.\n\n## Affected\n\n- `LibreSSL <= 4.4.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}