LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-118373 · Microsoft / collected KEV context

cve-program · CVE-2026-118373

• https://github.com/openbsd/src/commit/0f7039667044d1cd252cc72134e499186da4da25
• https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L299
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
• https://github.com/libressl/portable
• https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-cleartext-transmission-of-ocsp-requests-via-url2host

• LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() · Newly collected advisory · 28 Oct 2026