Description
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| curl | curl | 8.6.0 – ≤ 8.6.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 8.7.1-1 | — |
| Debian 13 | curl | 8.7.1-1 | — |
| Debian 12 | curl | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 8.7.1-2.el7jbcs | RHSA-2024:2693 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.57-10.el7jbcs | RHSA-2024:2693 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_http2 | 1.15.19-37.el7jbcs | RHSA-2024:2693 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_jk +1 | 1.2.49-6.redhat_1.el7jbcs | RHSA-2024:2693 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_md | 1:2.4.24-6.el7jbcs | RHSA-2024:2693 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_proxy_cluster | 1.3.20-4.el7jbcs | RHSA-2024:2693 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_security | 2.9.3-36.el7jbcs | RHSA-2024:2693 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.57-10.el7jbcs | RHSA-2024:2693 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-nghttp2 +1 | 1.43.0-13.el7jbcs | RHSA-2024:2693 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | curl | 8.6.0-3.1 | SUSE-SU-2025:20029-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 8.7.1-1.1 | openSUSE-SU-2024:13805-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 8.7.1-r0 | — |
| Alpine v3.23 | curl | 8.7.1-r0 | — |
| Alpine v3.22 | curl | 8.7.1-r0 | — |
| Alpine v3.21 | curl | 8.7.1-r0 | — |
| Alpine v3.20 | curl | 8.7.1-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 8.7.1-r0 | — |
| Alpine v3.18 | curl | 8.7.1-r0 | — |
| Alpine v3.17 | curl | 8.7.1-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.30.3-2 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | curl | 8.7.1-r0 | — |
Advisories 14
- RHSA-2024:2693 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2024-0726 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 8, 2026
- SUSE-SU-2025:20029-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2024:13805-1 curl-8.7.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1725 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 11, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- SSA-331112 SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1 Siemens ProductCERT · Nov 12, 2024
- ICSA-24-319-04 Siemens SINEC NMS CISA ICS & IT advisories · Nov 12, 2024
- NCSC-2024-0362 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Sep 10, 2024
- SSA-417159 SSA-417159: Multiple Vulnerabilities in SINEMA Remote Connect Client Before V3.2 SP2 Siemens ProductCERT · Sep 10, 2024
- ICSA-24-256-10 Siemens SINEMA CISA ICS & IT advisories · Sep 10, 2024
- NCSC-2024-0320 Kwetsbaarheden verholpen in Apple MacOS NCSC-NL (Netherlands) · Jul 30, 2024
References
- json
- www
- issue
- http://www.openwall.com/lists/oss-security/2024/03/27/2
- https://security.netapp.com/advisory/ntap-20240531-0001/
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214118
- https://support.apple.com/kb/HT214120
- http://seclists.org/fulldisclosure/2024/Jul/20
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://seclists.org/fulldisclosure/2024/Jul/19