CVE and update status of the FreeBSD ports tree3,621 unaddressed CVEs in 714 portsAll times are CET
CVE details

CVE-2026-118374

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.

Score
8.2 high
Published
2026-10-28
Links
NVD · cve.org · Report wrong data

Matched ports (4)

PortPackageVersionStatusMaintainer
security/libressllibressl4.4.0unaddressedbrnrd@FreeBSD.org
security/libressllibressl-libtls4.4.0unaddressedbrnrd@FreeBSD.org
security/libressl-devellibressl-devel4.4.0unaddressedbrnrd@FreeBSD.org
security/libressl-devellibressl-devel-libtls4.4.0unaddressedbrnrd@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>libressl</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>libressl-libtls</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>libressl-devel</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>libressl-devel-libtls</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion
	vulnerability that allows malicious OCSP responders to exhaust memory
	by sending unbounded HTTP responses. Attackers controlling the
	responder or intercepting plain HTTP AIA OCSP traffic can stream
	endless headers or body data to http_head_read() and http_body_read(),
	denying certificate status checks.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-118374</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-118374</url>
    </references>
    <dates>
      <discovery>2026-10-28</discovery>
      <entry>2026-10-28</entry>
    </dates>
  </vuln>