Description
curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CURL | curl | 7.53.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.52.1-3 | — |
| Debian 13 | curl | 7.52.1-3 | — |
| Debian 12 | curl | 7.52.1-3 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 7.79.1-1.1 | openSUSE-SU-2024:10582-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 7.53.0-r0 | — |
| Alpine v3.23 | curl | 7.53.0-r0 | — |
| Alpine v3.22 | curl | 7.53.0-r0 | — |
| Alpine v3.21 | curl | 7.53.0-r0 | — |
| Alpine v3.20 | curl | 7.53.0-r0 | — |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 7.53.0-r0 | — |
| Alpine v3.18 | curl | 7.53.0-r0 | — |
| Alpine v3.17 | curl | 7.53.0-r0 | — |
| Alpine v3.16 | curl | 7.53.0-r0 | — |
| Alpine v3.15 | curl | 7.53.0-r0 | — |
| Alpine v3.14 | curl | 7.53.0-r0 | — |
| Alpine v3.13 | curl | 7.53.0-r0 | — |
| Alpine v3.12 | curl | 7.53.0-r0 | — |
| Alpine v3.11 | curl | 7.53.0 | — |
| Alpine v3.10 | curl | 7.53.0-r0 | — |
| Alpine v3.9 | curl | 7.53.0-r0 | — |
| Alpine v3.8 | curl | 7.53.0 | — |
| Alpine v3.7 | curl | 7.53.0 | — |
| Alpine v3.6 | curl | 7.53.0 | — |
| Alpine v3.5 | curl | 7.52.1-r2 | — |
| Alpine v3.4 | curl | 7.52.1-r2 | — |
| Alpine v3.3 | curl | 7.52.1-r1 | — |
| Alpine v3.2 | curl | 7.52.1-r1 | — |
Advisories 3
- openSUSE-SU-2024:10582-1 curl-7.79.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2023-1649 cURL: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 4, 2023