CVE-2026-118374
mediumLibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP r…
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt disclosure@vulncheck.com
- https://github.com/libressl/portable disclosure@vulncheck.com
- https://github.com/openbsd/src/blob/f6f428241d469cf434e60b73fc834d0448f068d5/usr.sbin/ocsp... disclosure@vulncheck.com
- https://github.com/openbsd/src/commit/bf5da63f53179ef423d18c56d6da89eaefb56228 disclosure@vulncheck.com
- https://github.com/openbsd/src/commit/de4274c56c9ace88232591d4c919d79281a8de59 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-memory-exhaustion-vi... disclosure@vulncheck.com