CVE-2026-118371: LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSPsendreqnew() and OCSPparseurl() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
The attacker needs to supply a certificate whose Authority Information Access extension contains an OCSP URI with carriage return and line feed characters in its request path. When the affected OCSP functions use that URI, the injected characters can alter the HTTP request sent to an OCSP responder or proxy.
Which deployments are exposed?
Deployments are exposed if they use LibreSSL through 4.4.0 and invoke libcrypto's OCSP_sendreq_new() or OCSP_parse_url() on certificate-provided OCSP URIs. The issue affects outbound OCSP POST request construction rather than requiring an attacker to authenticate to the target responder.
What is the practical impact of successful exploitation?
An attacker can inject HTTP headers or split requests in traffic sent to OCSP responders and proxies. The provided severity vector indicates integrity impact but no stated confidentiality or availability impact.