Executive brief
A vulnerability in the curl data transfer tool could allow it to incorrectly trust a server's security certificate even if there are known issues with its validity. This occurs when curl is configured to use a specific verification method called OCSP stapling on Apple devices like macOS and iOS. An attacker could potentially use this to present a revoked or invalid certificate without being detected, compromising the security of the connection.
Technical details
A vulnerability classified as Improper Certificate Validation (CWE-295) exists in curl when using the Certificate Status Request TLS extension (OCSP stapling). The flaw occurs specifically when curl is built with an OpenSSL-based backend (including BoringSSL, AWS-LC, LibreSSL, or QuicTLS) and utilizes Apple SecTrust to access the native CA store on Apple operating systems. In this configuration, curl fails to detect OCSP problems, wrongly considering invalid or problematic responses as valid. This allows a remote server to bypass certificate status checks. The issue was introduced in version 8.17.0 and is fixed in version 8.20.0.
Affected products
- curl curl 8.17.0 to 8.19.0
- curl libcurl 8.17.0 to 8.19.0
Timeline
- 2026-04-25: other: Reported to the curl project
- 2026-04-29: patched: Fixed in curl version 8.20.0
- 2026-04-29: advisory: Project advisory published
- 2026-05-13: disclosed: NVD publication date