Vulnerability in OpenBSD LibreSSL

[ Description ]Official description

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund27 Oct 2026WID-SEC-2026-4202

  LibreSSL: Multiple vulnerabilities Translated from German

  CVE-2026-118371CVE-2026-118374CVE-2026-118372+1 more CVEs

[ References ]References

• ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
• github.com/libressl/portable
• github.com/openbsd/src/blob/f6f428241d469cf434e60b73fc834d0448f068d5/usr.sbin/ocspcheck…
• github.com/openbsd/src/commit/bf5da63f53179ef423d18c56d6da89eaefb56228
• github.com/openbsd/src/commit/de4274c56c9ace88232591d4c919d79281a8de59
• www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-memory-exhaustion-via-unb…