Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-0853: curl may skip certificate revocation check on reused connections

CVE-2024-0853 · published 2 years ago

Summary

The curl tool can keep a TLS session ID even after it fails to verify a website's certificate revocation status. If the same site is contacted again while that session is still valid, curl may skip the revocation check and connect without confirming the certificate is still trustworthy. Update curl to the latest version or disable session reuse to ensure each connection validates the certificate properly.

What to do

Update debian curl to version 8.6.0-1.
Update curl to version 8.6.0-r0.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:13	debian	curl	< 8.6.0-1 Fix: upgrade to 8.6.0-1
Alpine:v3.17	–	curl	< 8.6.0-r0 Fix: upgrade to 8.6.0-r0
–	haxx	curl	8.5.0 `cpe:2.3:a:haxx:curl:8.5.0:::::::*`

Original advisory text

OCSP verification bypass with TLS session reuse

curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.

References

https://security-tracker.debian.org/tracker/CVE-2024-0853 Vendor Advisory
https://security.alpinelinux.org/vuln/CVE-2024-0853 Vendor Advisory
https://curl.se/docs/CVE-2024-0853.html URL
https://curl.se/docs/CVE-2024-0853.json URL
https://hackerone.com/reports/2298922 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0853.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-0853 Vendor Advisory
https://security.netapp.com/advisory/ntap-20240307-0004/ Vendor Advisory
https://security.netapp.com/advisory/ntap-20240426-0009/ Vendor Advisory
https://security.netapp.com/advisory/ntap-20240503-0012/ Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-295Improper Certificate Validation

Timeline

Published3 Feb 2024

Updated4 Nov 2026

First seen25 Apr 2026

Sources

CURL-CVE-2024-0853 · OSV

CVE-2024-0853 · NVD

DEBIAN-CVE-2024-0853 · OSV

ALPINE-CVE-2024-0853 · OSV

CVE-2024-0853 · OSV

Track software like this

Free during beta