libressl vulnerabilities

Products

• libressl/portable 4
• LibreSSL 2

Latest libressl CVEs

Newest publication first

1. CVE-2026-118374 LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

   Published 2026-10-28

   High·CVSS 8.2 EPSS 0.21%

   LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or b...

2. CVE-2026-118373 LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()

   Published 2026-10-28

   Medium·CVSS 6.3 EPSS 0.09%

   LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposin...

3. CVE-2026-118372 LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

   Published 2026-10-28

   Medium·CVSS 6.3 EPSS 0.15%

   LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places...

4. CVE-2026-118371 LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line

   Published 2026-10-28

   Medium·CVSS 6.3 EPSS 0.14%

   LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate'...

5. CVE-2015-5333 Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object identifiers in X.509 certi...

   Published 2020-01-23

   High·CVSS 7.5 EPSS 2.0%

   Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object identifiers in X.509 certificates.

6. CVE-2015-5334 Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certif...

   Published 2020-01-23

   Critical·CVSS 9.8 EPSS 3.5%

   Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability ex...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.