Vulnerability Description
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
- https://github.com/libressl/portable
- https://github.com/openbsd/src/blob/f6f428241d469cf434e60b73fc834d0448f068d5/usr
- https://github.com/openbsd/src/commit/bf5da63f53179ef423d18c56d6da89eaefb56228
- https://github.com/openbsd/src/commit/de4274c56c9ace88232591d4c919d79281a8de59
- https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-memory-exh
FAQ
What is CVE-2026-118374?
CVE-2026-118374 is a vulnerability with a CVSS score of 5.9 (MEDIUM). LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the respo...
How severe is CVE-2026-118374?
CVE-2026-118374 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-118374?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.