CVE-2026-118372: LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

Q: What input must an attacker control to trigger the issue?

The attacker needs a certificate whose AIA OCSP URI path contains CR/LF sequences. When ocspcheck processes that URI and constructs a POST request to the OCSP responder, the injected characters can add headers or split the request.

Q: How can I determine whether my deployment is affected?

Deployments using LibreSSL ocspcheck through version 4.4.0 are affected. The relevant exposure is when ocspcheck processes certificate-provided AIA OCSP URIs.

Published Oct 28, 2026

Updated

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and httpopen() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.

Affected Software

1 affected component

LibreSSL ocspcheck<=4.4.0

Event History

Oct 28, 2026

CVE Published

via MITRE·02:03 AM

Data Sourced

via MITRE·02:03 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What input must an attacker control to trigger the issue?

The attacker needs a certificate whose AIA OCSP URI path contains CR/LF sequences. When ocspcheck processes that URI and constructs a POST request to the OCSP responder, the injected characters can add headers or split the request.

How can I determine whether my deployment is affected?