Skip to content
OpenAdvisories

Product · OpenBSD

LibreSSL

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-118373

    LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()

    LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on n…

    OpenBSD LibreSSL
  • Low 3.7
    CVE-2026-118372

    LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

    LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters an…

    OpenBSD LibreSSL
  • Low 3.7
    CVE-2026-118371

    LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line

    LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed charact…

    OpenBSD LibreSSL