CVE-2026-118371 — Vulnerability intelligence
—
Published:
- CVSS
- 6.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.