Is CVE-2026-118373 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-118373?

CVE-2026-118373 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-118373

Description

LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.