CVE-2026-118371

LowCVSS 3.7/10Last modified Nov 3, 2026

Description

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-93

Affected software

Vendor	Product	Versions
OpenBSD	LibreSSL	<= 4.4.0

References

Timeline

Published: Oct 28, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1183723.7LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF seq CVE-2026-1183733.7LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_al CVE-2026-1183745.9LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sendi CVE-2026-1183758.1llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows CVE-2026-1183765.3WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 address CVE-2026-1183777.5mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to for CVE-2026-1183787.8Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements b CVE-2026-118384.3Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Ind CVE-2026-1183839.0A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The c CVE-2026-1183846.1GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.CVE-2026-1183866.5Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were d CVE-2026-118399.9Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell t