When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | Oct 1, 2024 | Sep 11, 2024 |
| Debian | — | Upgrade curl | Nov 11, 2024 | Sep 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Nov 11, 2024 | Sep 11, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libcurlUpgrade curl | Dec 12, 2024 | Sep 11, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade curlUpgrade libcurl | Dec 12, 2024 | Sep 11, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libcurlUpgrade curl | Nov 11, 2024 | Sep 11, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 11, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.3Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.1.10Upgrade Splunk Enterprise to version 9.3.5 | Jul 30, 2026 | Sep 11, 2024 |
| Suse | — | Upgrade curl-zsh-completionUpgrade libcurl-devel-32bitUpgrade libcurl-mini4Upgrade libcurl-devel-docUpgrade libcurl4-32bitUpgrade libcurl-develUpgrade curlUpgrade libcurl4 | Dec 31, 2024 | Sep 11, 2024 |
| Ubuntu | — | Upgrade libcurl4-openssl-dev (Ubuntu Pro)Upgrade libcurl4-nss-dev (Ubuntu Pro)Upgrade libcurl3t64-gnutlsUpgrade libcurl4t64Upgrade libcurl3 (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3-nss (Ubuntu Pro)Upgrade curl (Ubuntu Pro)Upgrade libcurl3-gnutlsUpgrade curlUpgrade libcurl3-nssUpgrade libcurl4Upgrade libcurl4-gnutls-dev (Ubuntu Pro) | Sep 17, 2024 | Sep 11, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Sep 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub