curl / Docs / curl CVEs / OCSP verification bypass with TLS session reuse
Awarded 540 USD


OCSP verification bypass with TLS session reuse

Project curl Security Advisory, January 31 2024 - Permalink


curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.


This issue is limited to curl built to use OpenSSL and when using TLS 1.2 only and not TLS 1.3.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2024-0853 to this issue.

CWE-299: Improper Check for Certificate Revocation

Severity: Low


libcurl is used by many applications, but not always advertised as such!

This flaw is also accessible using the curl command line tool.


If verify status fails, make sure the session id is not cached.


A - Upgrade curl to version 8.6.0

B - Apply the patch to your local version

C - Do not use curl built to use OpenSSL

D - Do not allow TLS 1.2 for your transfers


This issue was reported to the curl project on December 29, 2023. We contacted distros@openwall on January 24, 2024.

curl 8.6.0 was released on January 31 2024 around 07:00 UTC, coordinated with the publication of this advisory.


Thanks a lot!