LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-118374 · Microsoft / collected KEV context

cve-program · CVE-2026-118374

• https://github.com/openbsd/src/commit/bf5da63f53179ef423d18c56d6da89eaefb56228
• https://github.com/openbsd/src/commit/de4274c56c9ace88232591d4c919d79281a8de59
• https://github.com/openbsd/src/blob/f6f428241d469cf434e60b73fc834d0448f068d5/usr.sbin/ocspcheck/http.c#L419
• https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
• https://github.com/libressl/portable
• https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-memory-exhaustion-via-unbounded-ocsp-http-response

• LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response · Newly collected advisory · 28 Oct 2026