Detections
Analytics
FreeBSD : LibreSSL -- Multiple OCSP client vulnerabilities (aafad06c-d519-11f1-8135-8447094a420f)
medium Nessus Plugin ID 374823
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the aafad06c-d519-11f1-8135-8447094a420f advisory.VulnCheck reports:
CVE-2026-118371: LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.
CVE-2026-118372: LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path.
Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.
CVE-2026-118373: LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
CVE-2026-118374: LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.
Tenable has extracted the preceding description block directly from the FreeBSD security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
https://nvd.nist.gov/vuln/detail/CVE-2026-118371
https://nvd.nist.gov/vuln/detail/CVE-2026-118372
https://nvd.nist.gov/vuln/detail/CVE-2026-118373
https://nvd.nist.gov/vuln/detail/CVE-2026-118374
Plugin Details
Severity: Medium
ID: 374823
File Name: freebsd_pkg_aafad06cd51911f181358447094a420f.nasl
Version: 1.1
Type: Local
Family: FreeBSD Local Security Checks
Published: 11/1/2026
Updated: 11/1/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.73
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2026-118373
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2026-118372
CVSS v4
Risk Factor: Medium
Base Score: 6.3
Threat Score: 1.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-118372
Vulnerability Information
CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:libressl-devel, p-cpe:/a:freebsd:freebsd:libressl
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Exploit Ease: No known exploits are available
Patch Publication Date: 10/31/2026
Vulnerability Publication Date: 10/28/2026
Reference Information
CVE: CVE-2026-118371, CVE-2026-118372, CVE-2026-118373, CVE-2026-118374