Description
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| curl | curl | 8.9.1 – ≤ 8.9.1, 8.9.0 – ≤ 8.9.0, 8.8.0 – ≤ 8.8.0, 8.7.1 – ≤ 8.7.1, 8.7.0 – ≤ 8.7.0, 8.6.0 – ≤ 8.6.0, 8.5.0 – ≤ 8.5.0, 8.4.0 – ≤ 8.4.0, 8.3.0 – ≤ 8.3.0, 8.2.1 – ≤ 8.2.1, 8.2.0 – ≤ 8.2.0, 8.1.2 – ≤ 8.1.2, 8.1.1 – ≤ 8.1.1, 8.1.0 – ≤ 8.1.0, 8.0.1 – ≤ 8.0.1, 8.0.0 – ≤ 8.0.0, 7.88.1 – ≤ 7.88.1, 7.88.0 –… | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 8.10.0-1 | — |
| Debian 13 | curl | 8.10.0-1 | — |
| Debian 12 | curl | 7.88.1-10+deb12u8 | — |
| Debian 11 | curl | 7.74.0-1.3+deb11u14 | DLA-3951-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | curl | 8.5.0-2ubuntu10.4 | USN-7012-1 |
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.18 | USN-7012-1 |
| Ubuntu 20.04 LTS | curl | 7.68.0-1ubuntu2.24 | USN-7012-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | curl | 7.58.0-2ubuntu3.24+esm10 | — |
| Ubuntu Pro 16.04 LTS | curl | 7.47.0-1ubuntu2.19+esm17 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | curl | 8.6.0-150600.4.6.1 | SUSE-SU-2024:3204-1 |
| SLES 15 SP5 | curl | 8.0.1-150400.5.50.1 | SUSE-SU-2024:3211-1 |
| SLES 12 SP5 | curl | 8.0.1-11.92.1 | SUSE-SU-2024:3203-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | curl | 8.0.1-11.92.1 | SUSE-SU-2024:3203-1 |
| SLE Micro 6.1 | curl | 8.12.1-slfo.1.1_1.1 | SUSE-SU-2025:20239-1 |
| SLE Micro 5.5 | curl | 8.0.1-150400.5.50.1 | SUSE-SU-2024:3211-1 |
| SLE Micro 5.4 | curl | 8.0.1-150400.5.50.1 | SUSE-SU-2024:3211-1 |
| SLE Micro 5.3 | curl | 8.0.1-150400.5.50.1 | SUSE-SU-2024:3211-1 |
| SLE Micro 5.2 | curl | 7.66.0-150200.4.78.1 | SUSE-SU-2024:3202-1 |
| SLE Micro 5.1 | curl | 7.66.0-150200.4.78.1 | SUSE-SU-2024:3202-1 |
| SUSE Linux Enterprise Installer Updates 15 SP5 | curl | 8.0.1-150400.5.50.1 | SUSE-SU-2024:3211-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 8.10.0-1.1 | openSUSE-SU-2024:14333-1 |
| openSUSE Leap 15.6 | curl | 8.6.0-150600.4.6.1 | SUSE-SU-2024:3204-1 |
| openSUSE Leap 15.5 | curl | 8.0.1-150400.5.50.1 | SUSE-SU-2024:3211-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | curl | 8.0.1-150400.5.50.1 | SUSE-SU-2024:3211-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 8.10.0-r0 | — |
| Alpine v3.23 | curl | 8.10.0-r0 | — |
| Alpine v3.22 | curl | 8.10.0-r0 | — |
| Alpine v3.21 | curl | 8.10.0-r0 | — |
| Alpine v3.20 | curl | 8.10.0-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 8.10.0-r0 | — |
| Alpine v3.18 | curl | 8.10.0-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.30.3-2 | — |
| Azure Linux 3 | curl | 8.8.0-3 | — |
| Azure Linux 2 (CBL-Mariner) | cmake | 3.21.4-18 | — |
| Azure Linux 2 (CBL-Mariner) | curl | 8.8.0-3 | — |
| Azure Linux 2 (CBL-Mariner) | mysql | 8.0.36-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | curl | 8.10.0-r0 | — |
Advisories 15
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2024-2114 cURL: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 9, 2026
- USN-7012-1 curl vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2025:20239-1 Security update for curl SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-3951-1 curl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ICSA-26-043-06 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 Siemens ProductCERT · Feb 24, 2026
- SUSE-SU-2024:3202-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14333-1 curl-8.10.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3211-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0143 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 17, 2025
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- SUSE-SU-2024:3203-1 Security update for curl SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2024:3204-1 Security update for curl SUSE / openSUSE Security Updates · May 2, 2025
- NCSC-2025-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 22, 2025