CVE-2024-8096
Publication date 11 September 2024
Last updated 10 July 2026
Ubuntu priority
Description
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | 26.04 LTS resolute |
Fixed 8.9.1-2ubuntu2
|
| 24.04 LTS noble |
Fixed 8.5.0-2ubuntu10.4
|
|
| 22.04 LTS jammy |
Fixed 7.81.0-1ubuntu1.18
|
|
| 20.04 LTS focal |
Fixed 7.68.0-1ubuntu2.24
|
|
| 18.04 LTS bionic |
Fixed 7.58.0-2ubuntu3.24+esm10
|
|
| 16.04 LTS xenial |
Fixed 7.47.0-1ubuntu2.19+esm17
|
|
| 14.04 LTS trusty |
Not affected
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
mdeslaur
introduced in 7.41.0
rodrigo-zaiden
commit that introduced is: https://github.com/curl/curl/commit/f13669a375f
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.5 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Related Ubuntu Security Notices (USN)
- USN-7012-1
- curl vulnerability
- 16 September 2024
- USN-8525-1
- curl vulnerabilities
- 9 July 2026