Description (CNA)
When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| curl / curl | affected 8.19.0 through 8.19.0; affected 8.18.0 through 8.18.0; affected 8.17.0 through 8.17.0 |
CWE
No CWE identifiers supplied.
References
- https://curl.se/docs/CVE-2026-7009.json
- https://curl.se/docs/CVE-2026-7009.html
- https://hackerone.com/reports/3694390
ADP enrichment
No English description supplied.
No English description supplied.