LibreSSL ocspcheck versions up to 4.4.0 are vulnerable to CRLF injection that allows an attacker to embed carriage return and line feed sequences in the AIA OCSP URI path of a certificate. This leads to the creation of arbitrary HTTP headers or the splitting of OCSP requests sent to the responder host, potentially enabling header manipulation or request smuggling. The weakness is classified as CWE‑93, a category of CRLF injection vulnerabilities that can alter communication protocols.

The vulnerability affects OpenBSD LibreSSL releases through 4.4.0, specifically the ocspcheck utility that resolves OCSP URLs. Any installation of LibreSSL in this version range that processes user-supplied certificates is potentially impacted. No specific sub-versions beyond 4.4.0 are listed as affected, so versions newer than 4.4.0 are presumed safe unless otherwise noted by the vendor.

The CVSS score is 6.3, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is that an attacker can supply or tamper with a certificate that includes a malicious AIA OCSP URI path, which the ocspcheck utility will send in a POST request, enabling the injection of headers. Because the path is parsed without rejecting control characters, the exploit does not require elevated privileges or specialized tooling beyond the ability to influence certificate data. The absence of a public exploit does not preclude local or remote attackers from leveraging this weakness if they can control certificate input or the environment where ocspcheck operates.