MediumFix available
curl — security advisory
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
- Products
- curl
- Affected versions
- 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u1~bpo11+1, 7.88.1-10+deb12u2, 7.88.1-10+deb12u3, 7.88.1-10+deb12u3~bpo11+1, 7.88.1-10+deb12u4, 7.88.1-10+deb12u5, 7.88.1-10+deb12u5~bpo11+1, 7.88.1-10+deb12u6, 7.88.1-10+deb12u6~bpo11+1, 7.88.1-10+deb12u7
- Fixed versions
- 7.88.1-10+deb12u8, 8.10.0-1
- CVEs
- CVE-2024-8096
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 16:44 UTC · Revision 1
Source evidence
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
osv:DEBIAN-CVE-2024-8096
curl
Fixed versions: 7.88.1-10+deb12u8
curl
Fixed versions: 8.10.0-1
curl
Fixed versions: 8.10.0-1
Complete source record
{
"id": "79bbadf97b04dd9b011f6fb669f32e102a6f06616d7054c9564a0d2429f9dbae",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2024-8096",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2024-8096",
"summary": "When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.",
"evidence": "osv:DEBIAN-CVE-2024-8096",
"products": [
{
"name": {
"value": "curl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.88.1-10+deb12u8",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "7.88.1-10",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u1~bpo11+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u3~bpo11+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u5~bpo11+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u6",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u6~bpo11+1",
"evidence": "/affected/0/versions"
},
{
"value": "7.88.1-10+deb12u7",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "curl",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.10.0-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "curl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "8.10.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2024-8096",
"aliases": [
"DEBIAN-CVE-2024-8096"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.88.1-10+deb12u8"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/debian/curl?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"7.88.1-10",
"7.88.1-10+deb12u1",
"7.88.1-10+deb12u1~bpo11+1",
"7.88.1-10+deb12u2",
"7.88.1-10+deb12u3",
"7.88.1-10+deb12u3~bpo11+1",
"7.88.1-10+deb12u4",
"7.88.1-10+deb12u5",
"7.88.1-10+deb12u5~bpo11+1",
"7.88.1-10+deb12u6",
"7.88.1-10+deb12u6~bpo11+1",
"7.88.1-10+deb12u7"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-8096.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.10.0-1"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/debian/curl?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-8096.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.10.0-1"
}
]
}
],
"package": {
"name": "curl",
"purl": "pkg:deb/debian/curl?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-8096.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T09:47:38.350734078Z",
"provider": "osv",
"upstream": [
"CVE-2024-8096"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2024-8096"
]
},
"related_cves": [
{
"value": "CVE-2024-8096",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 328083,
"published_at": "2024-09-11T10:15:02.883+00:00"
}