CVE-2026-118374: LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to httpheadread() and httpbodyread(), denying certificate status checks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments that use LibreSSL ocspcheck to contact OCSP responders are exposed when a responder is malicious or when OCSP traffic uses plain HTTP AIA endpoints that an attacker can intercept. The impact is denial of certificate status checks through memory exhaustion.
What does an attacker need to exploit this issue?
The attacker must control the OCSP responder or be able to intercept plain HTTP AIA OCSP traffic. They can then send an unbounded HTTP response, including endless headers or body data.
Which versions are affected?
LibreSSL ocspcheck through version 4.4.0 is affected.