CVE-2026-118374

LibreSSL ocspcheck through version 4.4.0 is vulnerable to a memory exhaustion vulnerability (CWE-770). The flaw exists because the application fails to limit the size of HTTP responses from OCSP responders. Malicious responders or attackers intercepting plain HTTP AIA OCSP traffic can stream unbo...

EUVD-2026-111550

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to...

CVE-2026-118373

The LibreSSL ocspcheck utility (versions through 4.4.0 ) is vulnerable to a cleartext transmission vulnerability. The root cause is that the url2host() function discards the OCSP URL scheme, while http_alloc() only selects TLS for port 443. Consequently, an on-path network attacker can intercept ...

EUVD-2026-111549

LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host discards the OCSP URL scheme and httpalloc only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial...

CVE-2026-118372

LibreSSL ocspcheck versions through 4.4.0 are vulnerable to a CRLF injection vulnerability. The issue exists because the url2host() function copies the URI path without rejecting control characters, while http_open() subsequently includes this path in the POST request line. An attacker can exploi...

EUVD-2026-111548

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host copies the path without rejecting control characters and httpopen places it in the POST request...