CVE-2026-118374
Last modified
CVE-2026-118374 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| OpenBSD | LibreSSL | <= 4.4.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-118374?
How severe is CVE-2026-118374?
How do I fix CVE-2026-118374?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11836Insufficient verification of data authenticity in Caliptra C…1.8
- CVE-2026-11837A local privilege escalation vulnerability was found in the …7.3
- CVE-2026-118370libexpat through 2.9.0 contains a signed integer overflow vu…5.9
- CVE-2026-118371LibreSSL through 4.4.0 contains a CRLF injection vulnerabili…3.7
- CVE-2026-118372LibreSSL ocspcheck through 4.4.0 contains a CRLF injection v…3.7
- CVE-2026-118373LibreSSL ocspcheck through 4.4.0 contains a cleartext transm…3.7
- CVE-2026-118375llama.cpp b8841 before b11865 contains an out-of-bounds writ…8.1
- CVE-2026-118376WeKnora before 0.8.2 contains a server-side request forgery …5.3
- CVE-2026-118377mews/pos through 2.0.0 contains an insufficient verification…7.5
- CVE-2026-118378Tabularis before 0.28.0 contains an SQL injection vulnerabil…7.8
- CVE-2026-11838Missing authentication for critical function vulnerability i…4.3
- CVE-2026-118384GNU mtools through 4.0.49 has an out-of-bounds write in pars…6.1
Are you affected by CVE-2026-118374?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST