curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Mar 21, 2024 | Feb 3, 2024 |
| Amazon_linux_2023 | — | Upgrade libcurlUpgrade libcurl-debuginfoUpgrade curl-minimalUpgrade libcurl-develUpgrade curl-debuginfoUpgrade curl-minimal-debuginfoUpgrade curlUpgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade curl-debugsource | Feb 17, 2025 | Jan 31, 2024 |
| Debian | — | Upgrade curl | Jul 27, 2026 | Jul 27, 2026 |
| Freebsd | — | Upgrade curl | Feb 29, 2024 | Feb 28, 2024 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Sep 24, 2024 | Feb 3, 2024 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory5 | Jun 25, 2024 | Feb 3, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.5Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.4.3 | Jul 30, 2026 | Feb 3, 2024 |
| Suse | — | Upgrade libcurl-mini4Upgrade curlUpgrade curl-zsh-completionUpgrade libcurl4-32bitUpgrade libcurl-develUpgrade libcurl-devel-docUpgrade libcurl4 | Oct 31, 2024 | Feb 3, 2024 |
| Ubuntu | — | Upgrade curl | Nov 19, 2024 | Feb 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub