{"id":"CVE-2024-0853","aliases":["ALPINE-CVE-2024-0853","AZL-34061","AZL-34648","BELL-CVE-2024-0853","CURL-CVE-2024-0853","DEBIAN-CVE-2024-0853","EUVD-2024-16636","GHSA-697h-9h25-w4fm","JLSEC-2026-412","UBUNTU-CVE-2024-0853","openSUSE-SU-2024:13637-1"],"status":"published","title":"OCSP verification bypass with TLS session reuse","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01102,"percentile":0.65983,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2024-01-31T00:00:00Z","modified":"2026-11-02T12:00:09Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["8.8.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"curl","fixed_in":["8.8.0-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.5.0-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.6.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.6.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.6.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.6.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.6.0+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"curl","fixed_in":["8.5.0-2ubuntu2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"curl","fixed_in":["8.6.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.8.0-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0-r0"},{"fixed":"8.5.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0-r0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0-r0"},{"fixed":"8.6.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0+0"},{"fixed":"8.6.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0+0"},{"fixed":"8.6.0+0"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu2"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.0-1.1"}]}]}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"haxx","product":"curl"}],"references":[{"url":"https://curl.se/docs/CVE-2024-0853.json","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://curl.se/docs/CVE-2024-0853.html","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://hackerone.com/reports/2298922","tags":["x_transferred","Exploit","Issue Tracking","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240307-0004/","tags":["x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240426-0009/","tags":["x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240503-0012/","tags":["x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0853","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240307-0004","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240426-0009","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240503-0012","tags":["web"]},{"url":"https://github.com/advisories/GHSA-697h-9h25-w4fm","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-0853","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-0853","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-12","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0853.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-0853","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-0853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-0853","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0853","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-0853","title":"OCSP verification bypass with TLS session reuse","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-02-03T13:35:25.863Z","modified":"2025-06-20T20:04:09.066Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:22.852179Z"}],"euvd":[{"id":"EUVD-2024-16636","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-02-03T13:35:25Z","modified":"2025-06-20T20:04:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:18.218874Z"}],"ghsa":[{"id":"GHSA-697h-9h25-w4fm","title":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify...","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-02-03T15:30:28Z","modified":"2026-03-19T05:08:28Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:06:42.326312Z"}],"nvd":[{"id":"CVE-2024-0853","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-02-03T14:15:50.85Z","modified":"2026-06-17T06:54:26.133Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:09:34.891666Z"}],"osv":[{"id":"ALPINE-CVE-2024-0853","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-02-03T14:15:50.85Z","modified":"2026-11-02T11:17:50.050206856Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-34061","title":"CVE-2024-0853 affecting package curl for versions less than 8.8.0-1","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-02-03T14:15:50Z","modified":"2026-04-21T04:27:00.782052Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34648","title":"CVE-2024-0853 affecting package curl for versions less than 8.8.0-1","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-02-03T14:15:50Z","modified":"2026-04-21T04:32:27.720423Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"BELL-CVE-2024-0853","status":"published","published":"2024-02-01T05:57:36.342438Z","modified":"2026-01-26T09:42:47.583377Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-0853","title":"OCSP verification bypass with TLS session reuse","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-02-03T13:35:25.863Z","modified":"2026-10-28T02:31:04.612724229Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"DEBIAN-CVE-2024-0853","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-02-03T14:15:50.85Z","modified":"2026-11-02T12:00:09.68351888Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"JLSEC-2026-412","title":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status...","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-25T18:24:23.720309212Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"UBUNTU-CVE-2024-0853","description":"curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.","status":"published","published":"2024-01-31T00:00:00Z","modified":"2026-04-22T14:38:05.116231Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"CURL-CVE-2024-0853","title":"OCSP verification bypass with TLS session reuse","description":"curl inadvertently kept the SSL session ID for connections in its cache even\nwhen the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh,\nwhich then skipped the verify status check.","status":"published","published":"2024-01-31T08:00:00Z","modified":"2026-10-25T01:05:27.320519638Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"openSUSE-SU-2024:13637-1","title":"curl-8.6.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:15:38.319778Z","updated_at":"2026-11-02T16:58:36.327643Z"}]}}