The flaw lies in the OCSP_sendreq_new and OCSP_parse_url functions, which write the request path directly into the OCSP POST line without stripping CR or LF characters. An attacker can craft a certificate whose AIA OCSP URI contains injected CRLF sequences, causing the resulting OCSP request to carry arbitrary HTTP headers or even split into multiple requests. The injected headers could redirect a responder or proxy, lead to information disclosure, or facilitate further attacks depending on the responder’s behavior.

OpenBSD LibreSSL versions up to 4.4.0 are impacted. The vulnerability appears in the libcrypto OCSP implementation packaged with LibreSSL 4.4.0 and earlier releases.

The vulnerability has a CVSS score of 6.3 and is not listed in the CISA KEV catalog, indicating moderate severity and currently low exploitation probability. The attack vector is likely remote, achieved by delivering a malicious certificate to a system that generates OCSP requests. Successful exploitation requires the target to use an affected LibreSSL version for OCSP queries, a condition that may be common in network services or browsers that rely on LibreSSL as the default TLS library.