LibreSSL ocspcheck through version 4.4.0 contains a flaw where the function url2host() removes the URL scheme, and http_alloc() applies TLS protection only on port 443. As a result, OCSP requests sent to HTTPS responder URLs on non‑443 ports are transmitted in cleartext. This allows an on‑path attacker to read sensitive components of the request—including certificate serial numbers, issuer hashes, and nonces—thereby compromising confidentiality. The weakness is a cleartext transmission of sensitive information (CWE‑319).

The affected product is OpenBSD LibreSSL, specifically versions 4.4.0 and earlier. The vulnerability occurs in the ocspcheck utility used to query OCSP responders.

The CVSS assessment of 6.3 indicates medium severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The vulnerability requires an on‑path network attacker capable of observing traffic to OCSP responder URLs that run on ports other than 443. Because the data transmitted includes certificate identifiers and nonce values, the attacker can gather reconnaissance information that could assist in future spoofing or other certificate‑related attacks. Although the attack does not provide remote code execution, the exposure of these values represents a tangible confidentiality risk.