CVE-2026-7009
Fixed in a distro release EPSS <1%CVSS 5.3
When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine.
Products: curl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | curl | 8.20.0-r0 |
| Alpine 3.24 | curl | 8.20.0-r0 |
| Red Hat hummingbird 1 | curl | 0:8.20.0-2.hum1 |
| Red Hat hummingbird 1 | libcurl | 0:8.20.0-2.hum1 |
| Red Hat hummingbird 1 | libcurl-devel | 0:8.20.0-2.hum1 |
| Red Hat hummingbird 1 | libcurl-minimal | 0:8.20.0-2.hum1 |