CVE-2026-118374highCWE-770

CVE-2026-118374: high-severity vulnerability in OpenBSD LibreSSL

LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

Published · Updated

Follow this CVE+ Monitor LibreSSL

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.2%
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
OpenBSD · LibreSSL
Related CVEs — OpenBSD LibreSSL

In the same product, most dangerous first.

CVE-2026-118372MEDIUMLibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL PathEPSS 0.1%CVE-2026-118371MEDIUMLibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request LineEPSS 0.1%CVE-2026-118373MEDIUMLibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()EPSS 0.1%