CVE-2024-0853
OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
CVE-2024-0853- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List
OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
CVE-2024-0853- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
EUVDEUVD-2024-16636
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
EUVD-2024-16636- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-697h-9h25-w4fm
curl inadvertently kept the SSL session ID for connections in its cache even when the verify...
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
GHSA-697h-9h25-w4fm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-0853
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
ALPINE-CVE-2024-0853- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVAZL-34061
CVE-2024-0853 affecting package curl for versions less than 8.8.0-1
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
AZL-34061- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVAZL-34648
CVE-2024-0853 affecting package curl for versions less than 8.8.0-1
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
AZL-34648- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVBELL-CVE-2024-0853
- Record
BELL-CVE-2024-0853- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV
OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
CVE-2024-0853- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-0853
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
DEBIAN-CVE-2024-0853- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-412
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status...
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
JLSEC-2026-412- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-0853
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
UBUNTU-CVE-2024-0853- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCURL-CVE-2024-0853 No score
OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
- Record
CURL-CVE-2024-0853- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13637-1 No score
curl-8.6.0-1.1 on GA media
These are all security issues fixed in the curl-8.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13637-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.17 |
before 8.6.0-r0 | 8.6.0-r0 |
curlAlpine:v3.18 |
before 8.6.0-r0 | 8.6.0-r0 |
curlAlpine:v3.19 |
before 8.6.0-r0 | 8.6.0-r0 |
curlAlpine:v3.20 |
before 8.6.0-r0 | 8.6.0-r0 |
curlAlpine:v3.21 |
before 8.6.0-r0 | 8.6.0-r0 |
curlAlpine:v3.22 |
before 8.6.0-r0 | 8.6.0-r0 |
curlAlpine:v3.23 |
before 8.6.0-r0 | 8.6.0-r0 |
curlAlpine:v3.24 |
before 8.6.0-r0 | 8.6.0-r0 |
curlAzure Linux:2 |
before 8.8.0-1 | 8.8.0-1 |
curlAzure Linux:3 |
before 8.8.0-1 | 8.8.0-1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
curlAlpaquita:23 |
8.5.0-r0 up to 8.5.0-r1 | 8.5.0-r1 |
curlAlpaquita:stream |
8.5.0-r0 up to 8.6.0-r0 | 8.6.0-r0 |
curlBellSoft Hardened Containers:stream |
8.5.0-r0 up to 8.6.0-r0 | 8.6.0-r0 |
curlDebian:13 |
before 8.6.0-1 | 8.6.0-1 |
curlDebian:14 |
before 8.6.0-1 | 8.6.0-1 |
CURL_jllJulia |
8.5.0+0 up to 8.6.0+0 | 8.6.0+0 |
LibCURL_jllJulia |
8.5.0+0 up to 8.6.0+0 | 8.6.0+0 |
curlUbuntu:24.04:LTS |
before 8.5.0-2ubuntu2, plus listed versions 8.2.1-1ubuntu38.2.1-1ubuntu3.18.4.0-2ubuntu18.5.0-2ubuntu1 |
8.5.0-2ubuntu2 |
curlopenSUSE:Tumbleweed |
before 8.6.0-1.1 | 8.6.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-0853 is a medium vulnerability (CVSS 5.3) in Curl, published January 31, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in curl 8.6.0-r0.
References
curl.se/docs/CVE-2024-0853.json
hackerone.com/reports/2298922
security.netapp.com/advisory/ntap-20240307-0004
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-0853
github.com/advisories/GHSA-697h-9h25-w4fm
security.alpinelinux.org/vuln/CVE-2024-0853
docs.bell-sw.com/security/cves/CVE-2024-0853
security-tracker.debian.org/tracker/CVE-2024-0853
ubuntu.com/security/CVE-2024-0853
cve.org/CVERecord?id=CVE-2024-0853
suse.com/security/cve/CVE-2024-0853