CVE-2026-118374
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sendi
CVSS
5.9
Média
EPSS
0.2%
p12
KEV
—
Exploit Today
3
0-100
Publicado: 28 de out. de 2026 · Última mod.: 2 de nov. de 2026 · CWE-770
0.2%EPSS · 30 dias0.2%
2026-10-282026-11-07
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
- ftp.openbsd.orghttps://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
- github.comhttps://github.com/libressl/portable
- github.comhttps://github.com/openbsd/src/blob/f6f428241d469cf434e60b73fc834d0448f068d5/usr.sbin/ocspcheck/http.c#L419
- github.comhttps://github.com/openbsd/src/commit/bf5da63f53179ef423d18c56d6da89eaefb56228
- github.comhttps://github.com/openbsd/src/commit/de4274c56c9ace88232591d4c919d79281a8de59
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-memory-exhaustion-via-unbounded-ocsp-http-response
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1236103.7 BAI—
———rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header requesting up to 1 GiB before authentication, aborting Brotli-enabled clients or client-authenticating servers whose allocator cannot satisfy the request.11hCVE-2026-1235777.5 ALT—
———Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory exhaustion and denial of service.11hCVE-2026-1235767.5 ALT—
———Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing pre-allocated buffers to persist without timeout and exhausting server memory.11hCVE-2026-1235757.5 ALT—
———Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.11hCVE-2026-1235697.5 ALT—
———The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service.11hCVE-2026-1235647.5 ALT—
———Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output.11h