CVE-2026-118371
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which wri
CVSS
3.7
Bajo
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 28 oct 2026 · Última mod.: 28 oct 2026 · CWE-93
Sin historial EPSS suficiente todavía.
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
- ftp.openbsd.orghttps://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
- github.comhttps://github.com/libressl/portable
- github.comhttps://github.com/openbsd/src/blob/3903c41d301d66facec69f7bf776b182cbc5ed62/lib/libcrypto/ocsp/ocsp_ht.c#L184
- github.comhttps://github.com/openbsd/src/commit/d3f7195f4849d8a699cea4a3a67677f4b3dc1591
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libressl-through-4.4.0-crlf-injection-via-ocsp-sendreq-new-request-line
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1153033.7 BAJ—
——0The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.4hCVE-2026-1183723.7 BAJ3.7%
——1LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.22hCVE-2026-1162378.4 ALT28.8%
——9A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.3dCVE-2026-1162359.1 CRÍ49.3%
——15A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.3dCVE-2026-1162349.1 CRÍ39.8%
——12A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.3dCVE-2026-1162339.1 CRÍ39.8%
——12A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.3d