PT-2026-127737

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP sendreq new and OCSP parse url functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Informati...