ZeroDay Findings
Sign inSign up

Findings

CVE-2024-8096

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fai…

Published Sep 11, 2024 · updated Oct 15, 2026 · haxx curl

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 11, 2024 · NIST NVD

    Detected

    When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

  2. Oct 15, 2026 · NIST NVD

    Updated

    When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.

Affected

  • cpe debian/debian linux11.0
  • cpe haxx/curlversion unspecified
  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/bootstrap osversion unspecified
  • cpe netapp/h300s firmwareversion unspecified
  • cpe netapp/h410s firmwareversion unspecified
  • cpe netapp/h500s firmwareversion unspecified
  • cpe netapp/h700s firmwareversion unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe netapp/ontap tools10

Sources

  • CVE.orgCVE-2024-8096

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2024-8096

    When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports

    nvd.nist.gov

References