OCSP Stapling Vulnerability in cURL Affecting Server Certificate Validation

CVE-2026-7009

What is CVE-2026-7009?

The vulnerability in cURL arises when the software uses the Certificate Status Request TLS extension, commonly known as OCSP stapling, for server certificate verification. In this scenario, cURL inadequately handles potential OCSP response errors, leading to a false sense of security regarding the validity of server certificates. This flaw permits attackers to exploit improper validation processes, potentially allowing malicious actors to misrepresent their identity and compromise secure communications. Users of cURL should be aware of this issue and take necessary precautions until a patch is applied.

References